Hostile 100% javascript Download

@antv/thumbnails-component 2.1.0

preinstall hook runs obfuscated malware

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-256bc90e44b4c04c841a0e77e80d3d27f6850aae94ef34065c590202e0a501ecd5a
URLhttps://registry.npmjs.org/@antv/thumbnails-component/-/thumbnails-component-2.1.0.tgz
MaleculeK₂(McLi)O₄(S₃As₅CaDy)H₆(Po₂Cm₈CrDb₁₃Os₃Ti)Md₃(InPa₉)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.