Hostile 100% javascript Download

v0-utils 999.999.8004

Exfiltrates environment variables to OOB

npm preinstall sends hostname through OAST DNS callbackNode exfiltrates hostname and user identity through Oastify DNS
SHA-256bcc3fcaa525ee38bee184bf2af9b885166a5388f31b5113685b7a533a1ca2652
URLhttps://registry.npmjs.org/v0-utils/-/v0-utils-999.999.8004.tgz
MaleculeO₃(Eu₃S₆Dy₂)H₄(Cm₅Db₄Os₃Po₂)Md₂(Pa₄In)

Also flagged by osv (MAL-2025-48090: Malicious code in v0-utils (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.