Hostile 100% javascript Download

cryptodao-sdk 99.99.99

Exfiltrates secrets via postinstall hook

Sends a serialized Node host profile through an HTTP POSTNode AWS env credential HTTP exfil
SHA-2566e0b61df808a3fe18fb5ebcdf650a2a6a1b9ea46c5c8ba668480dbd0245c017b
URLhttps://registry.npmjs.org/cryptodao-sdk/-/cryptodao-sdk-99.99.99.tgz
MaleculeO₅(Eu₅S₆CCaDy₂)H₅(Cm₇Db₄F₇Os₆Po₃)Md₃(Pa₄BkIn)

Also flagged by osv (MAL-2026-5969: Malicious code in cryptodao-sdk (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.