Hostile 100% javascript Download

rn-bitu 99.0.0

Exfiltrates secrets via Telegram

Hardcoded Telegram bot exfiltrates a host profileNPM install hook exfiltrates environment credentials
SHA-2569e1656d3fe041a381e9442c32ebb47d7e6e187fc97e404f54a8fb8851d57c29a
URLhttps://registry.npmjs.org/rn-bitu/-/rn-bitu-99.0.0.tgz
MaleculeO₅(Eu₂S₈CCaDy₂)H₅(Cm₆Db₂F₄Os₅Po₄)Md₂(Pa₆In)

Also flagged by osv (MAL-2026-7401: Malicious code in rn-bitu (npm)).

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.