Hostile 100% javascript Download

@antv/f2-wx 4.2.51

preinstall hook executes obfuscated payload

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-2568990076ab1c73f3262f9f988b419207e7e253525a0560c1c629fba10c4929c2b
URLhttps://registry.npmjs.org/@antv/f2-wx/-/f2-wx-4.2.51.tgz
MaleculeK₂(McLi)O₄(S₃As₅CaDy)H₇(Po₂Cm₇CrDb₁₃Os₃TiU)Md₃(InPa₄)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.