Hostile 100% javascript Download

@servicetitan/cp-api 1.115.7

Obfuscated dropper downloads and executes Bun

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-256b9e5d8eb95668c4e7b8f71ecf62c1f27a607115fba373b224c43163f88fe7fe9
URLhttps://registry.npmjs.org/@servicetitan/cp-api/-/cp-api-1.115.7.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₅(Cm₁₀Db₉F₇OsPo₆)Md₂(InPa₄)

Also flagged by osv (MAL-2026-11843: Malicious code in @servicetitan/cp-api (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.