Hostile 100% javascript Download

@mistralai/mistralai 2.2.2

preinstall setup.mjs bootstraps Bun runtimeGitHub/npm token regex harvesting
SHA-256ce7e4199506959fd7a71b64209b2c07b9c82e53a946aa7d78298dc9249230d01
URLhttps://registry.npmjs.org/@mistralai/mistralai/-/mistralai-2.2.2.tgz
MaleculeK(Li₄)O₆(C₂Ca₃CoS₄As₄Dy)H₈(Po₈Cm₃₈CrDb₁₉F₁₁HfOs₇U₂)Md₃(InPa₈)

Also flagged by osv (MAL-2026-3432: Malicious code in @mistralai/mistralai (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.