Hostile 100% javascript Download

@servicetitan/mfe-quick-actions 0.5.50

preinstall downloads and executes Bun

Obfuscated JavaScript targets AWS and GitHub runner credentialsTemp Bun runtime launches opaque payload
SHA-2569f4abb7c0aaef4b78871773a197bc234786ac94c6bce57bf1381c7183403415f
URLhttps://registry.npmjs.org/@servicetitan/mfe-quick-actions/-/mfe-quick-actions-0.5.50.tgz
MaleculeK(Li₂)O₅(CCaS₄As₂Xe)H₈(Cm₂₇Db₂₅F₇Hf₂Os₃Po₈TiU₈)Md₆(BkInPa₄V)

Also flagged by osv (MAL-2026-11899: Malicious code in @servicetitan/mfe-quick-actions (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.