Hostile 100% javascript Download

accounts-final-form 9.9.12

Downloads and executes obfuscated payload

Library import stages and detaches a fetched executablenpm entry import conceals a native payload sidecar
SHA-256d1abba87342eca9da418b43454358620e11c25fd505cd7713a68e2c2793e5854
URLhttps://registry.npmjs.org/accounts-final-form/-/accounts-final-form-9.9.12.tgz
MaleculeO₃(CS₂As)H₅(Cm₇Db₄F₅Os₂Po₆)Md₂(InPa)

Also flagged by osv (MAL-2026-11504: Malicious code in accounts-final-form (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.