Hostile 92% javascript Download

@ccfly/setup-darwin-arm64 0.1.10

C2 backdoor with agent tokens

Brokered WebSocket agent exposes a PTY-backed remote shellAd-hoc Signature
SHA-2568fc5b164a1d1ccffd6bdf15ec63730e1aff5adaf02149e6bdc1355ab15bb8eae
URLhttps://registry.npmjs.org/@ccfly/setup-darwin-arm64/-/setup-darwin-arm64-0.1.10.tgz
MaleculeO₂(CS₂)H₅(Cm₁₃Cr₆F₂OsPo₄)Md₂(Pa₂Si₃)

Also flagged by osv (MAL-2026-12084: Malicious code in @ccfly/setup-darwin-arm64 (npm)).

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.