Hostile 92% javascript Download

@redhat-cloud-services/vulnerabilities-client 2.1.9

preinstall executes obfuscated payload

Megabyte charcode-packed payload feeds direct evalPreinstall executes obfuscated bundled eval dropper
SHA-256b03f7fa11806471fc0c7f756d551f2de2f8e67027c6336ca0beb6150f2a7fe6b
URLhttps://registry.npmjs.org/@redhat-cloud-services/vulnerabilities-client/-/vulnerabilities-client-2.1.9.tgz
MaleculeO₂(S₄As₂)H₅(Cm₇Db₆F₃OsPo₂)Md₂(Pa₆)

Also flagged by osv (MAL-2026-5148: Malicious code in @redhat-cloud-services/vulnerabilities-client (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.