Hostile 100% javascript Download

lockedin-chai-chain 1.2.6

Remote code execution via C2

Axios response field compiled with require accessEncoded JSONKeeper endpoint with secret config
SHA-25693d2c45cec284b987376cbb51af0a8fb335c382443310f4cac171e58d8c6e989
URLhttps://registry.npmjs.org/lockedin-chai-chain/-/lockedin-chai-chain-1.2.6.tgz
MaleculeK(Li)O₃(C₃AsS)H₅(Cm₈Db₅OsPo₇Ti)Md₄(InLiPa₃)

Also flagged by osv (MAL-2026-2902: Malicious code in lockedin-chai-chain (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.