Hostile 100% javascript Download

@antv/l7plot-component 0.1.11

Preinstall hook runs obfuscated credential-stealing payload

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-256e0f72a38b515ee7e72608bb5259357c173b5ed899f3ba4b9910a3b5d6fa1863a
URLhttps://registry.npmjs.org/@antv/l7plot-component/-/l7plot-component-0.1.11.tgz
MaleculeK₂(McLi)O₄(S₃As₅CaDy)H₇(Po₂Cm₇CrDb₁₃Os₃TiU)Md₃(InPa₈)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.