Hostile 100% javascript Download

v0-runtime 999.999.999

Exfiltrates host info to webhook.site

JavaScript accesses hostname near an OOB endpoint and HTTP requestSecurity research claim paired with exfiltration endpoint
SHA-2568c5537b59080b0ad176ce526a8e44e93ca0db2ea20e22fa39c8db8a172e135fb
URLhttps://registry.npmjs.org/v0-runtime/-/v0-runtime-999.999.999.tgz
MaleculeO₂(Eu₂S₆)H₄(Cm₃Db₄Os₃Po)Md₂(Pa₅In)

Also flagged by osv (MAL-2025-48089: Malicious code in v0-runtime (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.