Hostile 100% javascript Download

@squawk/weather 0.5.8

Obfuscated credential stealer in preinstall

Kubernetes token pivots through cloud metadataMini Shai-Hulud setup.mjs preinstall Bun loader
SHA-256ccf624708bcede8692bdadd27c3936e96f0aca046745f5a1435b60886f12a0e0
URLhttps://registry.npmjs.org/@squawk/weather/-/weather-0.5.8.tgz
MaleculeK₂(McLi)O₆(C₂Ca₃CoLaS₄As₄)H₇(Po₇Cm₂₆Cr₃Db₂₁F₁₂Os₇Ti)Md₃(InPa₇)Th

Also flagged by osv (MAL-2026-3456: Malicious code in @squawk/weather (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.