Hostile 100% javascript Download

@antv/l7-three 2.27.10

preinstall hook executes obfuscated payload

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-2568bb5d9b9ac38bbda2923cc8ab659d801d936094ccf5da530b2e51f677e54be0a
URLhttps://registry.npmjs.org/@antv/l7-three/-/l7-three-2.27.10.tgz
MaleculeK₂(McLi)O₄(S₄As₅CaDy)H₆(Po₂Cm₇CrDb₁₄Os₃Ti)Md₃(InPa₈)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.