Hostile 100% javascript Download

@antv/g-plugin-canvas-path-generator 2.3.26

preinstall executes obfuscated malicious payload

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-2567b4a830a0ef50d0dab833f2b2f5705238524244e2d1940eb97ca17ec1bc10117
URLhttps://registry.npmjs.org/@antv/g-plugin-canvas-path-generator/-/g-plugin-canvas-path-generator-2.3.26.tgz
MaleculeK₂(McLi)O₄(S₃As₅CaDy)H₆(Po₂Cm₇CrDb₁₅Os₃Ti)Md₃(InPa₈)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.