Hostile 100% javascript Download

v0-runtime 999.999.25003

OOB exfiltration and install hooks

preinstall hook in sparse package with inflated version metadatapreinstall runs local JS contacting OOB callback
SHA-2567e03ce7c8870db1d055c9c806c93dba8f587b6c2a961fab934295c73317e0c84
URLhttps://registry.npmjs.org/v0-runtime/-/v0-runtime-999.999.25003.tgz
MaleculeO₂(S₆Eu)H₅(Cm₄DbF₂OsPo)Md₂(Pa₄In)

Also flagged by osv (MAL-2025-48089: Malicious code in v0-runtime (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.