Hostile 100% javascript Download

@onereach/channel-transformer 0.0.66

preinstall downloads and executes obfuscated payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-256bb562fd5eb618cb7787898e4df264e277e441ac5be2e881a479ebb40d5fbf644
URLhttps://registry.npmjs.org/@onereach/channel-transformer/-/channel-transformer-0.0.66.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₆(Cm₈Db₁₄F₇Os₂Po₇U₃)Md₃(InPa₇Pt)

Also flagged by osv (MAL-2026-11592: Malicious code in @onereach/channel-transformer (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.