Hostile 92% javascript Download

@array-util/nodepull 1.1.0

Obfuscated malicious npm package

Obfuscated JavaScript stages decoded content and hidden-launches itObfuscated Node bundle materializes a file and launches it hidden
SHA-256867cb78b8b5226d1d4254bce61db544c5ad9c28a188a0cb85bc1ff6663633081
URLhttps://registry.npmjs.org/@array-util/nodepull/-/nodepull-1.1.0.tgz
MaleculeO₄(CS₂AsXe)H₄(CrDb₃FPo)Md(Pa₂)

Also flagged by osv (MAL-2026-6084: Malicious code in @array-util/nodepull (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.