Hostile 100% javascript Download

lightweight-charts-4.1 11000.0.18

Exfiltrates environment via preinstall

Security research claim paired with exfiltration endpointHollow PoC package ships an extreme SemVer major
SHA-2568dbfc22a905cbcdcfb36d51f26382d4bd06215a02f907531dfaa68a51a1271f8
URLhttps://registry.npmjs.org/lightweight-charts-4.1/-/lightweight-charts-4.1-11000.0.18.tgz
MaleculeO₂(S₈Eu)H₂(CmDb)Md(Pa₅)

Also flagged by osv (MAL-2026-2817: Malicious code in lightweight-charts-4.1 (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.