Hostile 92% javascript Download

@hotcappuccino/nodepull 1.0.0

Obfuscated malicious npm package

Obfuscated JavaScript stages decoded content and hidden-launches itObfuscated Node bundle materializes a file and launches it hidden
SHA-256c519879b2ca6cd6fd4b1131721dfd247a0bb63cb1195d90faaf0c94853abb2fd
URLhttps://registry.npmjs.org/@hotcappuccino/nodepull/-/nodepull-1.0.0.tgz
MaleculeO₄(CS₂AsXe)H₄(CrDb₃FPo)Md(Pa₂)

Also flagged by osv (MAL-2026-6085: Malicious code in @hotcappuccino/nodepull (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.