Suspicious 86% javascript Download

@ikanngeming/ikannbail 1.0.5

preinstall hook, auto-follow remote list

“WhatsApp Web API Library”

Remotely controlled WhatsApp newsletter follow with concealmentAutomatically follows a WhatsApp newsletter on session open
SHA-256ccc6a9455aaad59987d46686324247675375efc75f1f8246044c39a8c7a0547a
URLhttps://registry.npmjs.org/@ikanngeming/ikannbail/-/ikannbail-1.0.5.tgz
MaleculeK(Li₂)O₉(I₂As₅C₃CaDyEuLaS₁₀Xe)H₈(Cm₃₄Cr₈Db₄₁F₄MgOs₆Po₁₀Ti₂)Md₄(In₁₁Pa₁₄Pt₃)

Also flagged by https://feeds.feedburner.com/TheHackersNews (101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent), osv (MAL-2026-17355: Malicious code in @ikanngeming/ikannbail (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.