Hostile 92% javascript Download

@nativescript-community/ui-pulltorefresh 2.5.4

Embedded Shai-Hulud malware payload

Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)Downloads latest trufflehog release
SHA-256b15f59cd287504e875cf969c35d527a39f21e5663acf1ac26aa2d1b60f7fb958
URLhttps://registry.npmjs.org/@nativescript-community/ui-pulltorefresh/-/ui-pulltorefresh-2.5.4.tgz
MaleculeK(Li₄)O₅(Eu₂S₂AsCa₂I)H₆(Cm₂₉Cr₄Db₁₉F₅Os₈Po₁₂)Md₂(Pa₃)Th

Also flagged by osv (MAL-2025-47161: Malicious code in @nativescript-community/ui-pulltorefresh (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.