Hostile 100% javascript Download

@ornikar/monorepo-config 14.3.9

Downloads and executes obfuscated payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-256cfa841c65903867e8f59783fa3d8af6ab4e34be398a3a2fd2dec12b9333a44e7
URLhttps://registry.npmjs.org/@ornikar/monorepo-config/-/monorepo-config-14.3.9.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₅(Cm₆Db₉F₈Os₂Po₆)Md₂(InPa₅)

Also flagged by osv (MAL-2026-11764: Malicious code in @ornikar/monorepo-config (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.