Hostile 100% javascript Download

@onereach/billing-dto 27.2.3

Obfuscated payload, preinstall hook, runtime download

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-256cbf0dfd7af20fc67bdfcd303fe7de1afdc5f8a369974e97e687d8357d202fce9
URLhttps://registry.npmjs.org/@onereach/billing-dto/-/billing-dto-27.2.3.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₅(Cm₆Db₁₀F₈OsPo₆)Md₂(InPa₄)

Also flagged by osv (MAL-2026-11589: Malicious code in @onereach/billing-dto (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.