Hostile 100% javascript Download

@servicetitan/anvil2-ext-common 0.7.2

Obfuscated payload, preinstall runtime download

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-256b4fecd0d515d4df205f8d68664ad1f8e4c31de6e588fa8957d05c5bcaea1f072
URLhttps://registry.npmjs.org/@servicetitan/anvil2-ext-common/-/anvil2-ext-common-0.7.2.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₆(Cm₆Db₉F₇Os₂Po₆U)Md₂(InPa₉)

Also flagged by osv (MAL-2026-11826: Malicious code in @servicetitan/anvil2-ext-common (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.