Hostile 93% javascript Download

@mistralai/mistralai-gcp 1.7.2

Obfuscated credential stealer in router_init.js

preinstall setup.mjs bootstraps Bun runtimeGitHub/npm token regex harvesting
SHA-256c13ab54e6204317af5eba4a3c486f2ed4dc58242f2f7d5407e216446a7f67691
URLhttps://registry.npmjs.org/@mistralai/mistralai-gcp/-/mistralai-gcp-1.7.2.tgz
MaleculeK(Li₃)O₆(C₂Ca₃CoS₃As₄Dy)H₆(Po₇Cm₂₇CrDb₁₅F₁₁Os₆)Md₃(InPa₆)

Also flagged by osv (MAL-2026-3512: Malicious code in @mistralai/mistralai-gcp (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.