Hostile 92% javascript Download

mailconfirmer 3.3.32

Malicious install hook payload

npm hidden encoded PowerShell loaderPowerShell downloads XOR temp EXE
SHA-256e15721ade0073e65d97621d456690dc1ddc56504149952087238df970fa61803
URLhttps://registry.npmjs.org/mailconfirmer/-/mailconfirmer-3.3.32.tgz
MaleculeO(S₃)H₆(Cm₆Db₂DsF₆Os₂Po₆)Md₃(InPa)

Also flagged by osv (MAL-2026-5750: Malicious code in mailconfirmer (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.