Hostile 93% javascript Download

@ensdomains/ccip-read-worker-viem 0.0.4

obfuscated preinstall credential stealer

Install hook bootstraps Bun sidecar runtimeObfuscated payload harvests multi-cloud secrets
SHA-25625460c9078a6ca44b2b690a4dea02ef4c2bfbef8a23eb3541845431195dbae8d
URLhttps://registry.npmjs.org/@ensdomains/ccip-read-worker-viem/-/ccip-read-worker-viem-0.0.4.tgz
MaleculeK₃(Li₁₂LuTe₂)O₁₂(S₁₄As₁₁Ca₆Eu₂AlC₁₄Co₂DyEr₂I₂P₃Xe₆)H₇(Cm₅₁Cr₃Db₃₀F₁₄Os₁₆Po₂₇U₃)Md₇(Bk₂In₂Pa₁₀PtV)Th

Also flagged by osv (MAL-2025-190725: Malicious code in @ensdomains/ccip-read-worker-viem (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.