Hostile 92% javascript Download

test1sharp 0.35.6

Obfuscated malware in preinstall hook

Preinstall executes obfuscated bundled eval dropperDetects JS obfuscation done by the js obfuscator (often malicious)
SHA-256ffc169034d9a948289e539e7122f4215097d416b4bef8fb6e91daaefb96b80bb
URLhttps://registry.npmjs.org/test1sharp/-/test1sharp-0.35.6.tgz
MaleculeO₄(S₂AlAsXe)H₆(Cm₅Cr₂Db₁₀FOs₇Po₇)Md₂(InPa₇)Th₂

Also flagged by osv (MAL-2026-2250: Malicious code in test1sharp (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.