Hostile 100% javascript Download

@onereach/ckeditor5-build-classic 30.0.3

preinstall downloads and executes obfuscated payload

Obfuscated JavaScript targets AWS and GitHub runner credentialspreinstall setup.mjs bootstraps Bun runtime
SHA-256c8f5325a4d69ab4049011fa722b69707538e2ce1537c10612b2f2b2002e7f529
URLhttps://registry.npmjs.org/@onereach/ckeditor5-build-classic/-/ckeditor5-build-classic-30.0.3.tgz
MaleculeK(Li)O₅(CCaS₅As₂Xe)H₈(Cm₉Db₁₉F₇Hf₂Os₃Po₆TiU₂)Md₄(BkInPa₄)

Also flagged by osv (MAL-2026-11594: Malicious code in @onereach/ckeditor5-build-classic (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.