Hostile 100% javascript Download

chai-assert-kit 3.8.1

Obfuscated dropper spawns hidden child process

Obfuscated HTTP response executes as JavaScriptPackage import detaches remote-code loader
SHA-256c9807b163b75196df759c1337e28ba829c3658698c93a813cd4c2842574bde10
URLhttps://registry.npmjs.org/chai-assert-kit/-/chai-assert-kit-3.8.1.tgz
MaleculeK(Li₄)O₃(As₂CS₂)H₄(Cm₃Db₁₀Os₄Po₄)Md₃(InPa)

Also flagged by osv (MAL-2026-6221: Malicious code in chai-assert-kit (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.