Hostile 100% javascript Download

@or-sdk/mcp-tools 0.5.2

obfuscated dropper downloads and executes payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-2568af9f92894795de3b09b4ad16453d5df627fddf3bbb25cf065b6f8b322b5ccb8
URLhttps://registry.npmjs.org/@or-sdk/mcp-tools/-/mcp-tools-0.5.2.tgz
MaleculeK₂(McLi)O₅(CCaS₄As₂Xe)H₆(Cm₉Db₈F₇OsPo₆U)Md₂(InPa₅)

Also flagged by osv (MAL-2026-11713: Malicious code in @or-sdk/mcp-tools (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.