Hostile 100% javascript Download

@redhat-cloud-services/vulnerabilities-client 2.1.8

preinstall executes obfuscated payload

Megabyte charcode-packed payload feeds direct evalPreinstall executes obfuscated bundled eval dropper
SHA-256a4a48f8b95dd4285ec2f360ff08f1180329d1a36582d134273e16193e8c89aae
URLhttps://registry.npmjs.org/@redhat-cloud-services/vulnerabilities-client/-/vulnerabilities-client-2.1.8.tgz
MaleculeO₂(S₄As₂)H₅(Cm₇Db₆F₃OsPo₂)Md₂(Pa₆)

Also flagged by osv (MAL-2026-5148: Malicious code in @redhat-cloud-services/vulnerabilities-client (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.