Hostile 100% javascript Download

tfjs-inference 1.0.0

Malicious postinstall beacon

Install hook host-profile beacon to fixed hostSquat ships upstream manifest link and recon
SHA-256823bb9c401d7c48ab501c0ae6522fa06b68379cb44a517f8b7e2f83d72211f74
URLhttps://r.cnpmjs.org/tfjs-inference/-/tfjs-inference-1.0.0.tgz
MaleculeO(S₆)H₄(Cm₄DbOs₄Po)Md₂(InPa₂)

Also flagged by osv (MAL-2026-14192: Malicious code in tfjs-inference (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.