Hostile 93% javascript Download

@mistralai/mistralai 2.2.3

Obfuscated credential stealer in preinstall

preinstall setup.mjs bootstraps Bun runtimeGitHub/npm token regex harvesting
SHA-256eb8167a3c38b12b278202e9bdcdc4227fc6301ca3c731ede9d28d811cb11a8e2
URLhttps://registry.npmjs.org/@mistralai/mistralai/-/mistralai-2.2.3.tgz
MaleculeK(Li₄)O₆(C₂Ca₃CoS₄As₄Dy)H₈(Po₈Cm₃₈CrDb₁₉F₁₁HfOs₇U₂)Md₃(InPa₈)

Also flagged by osv (MAL-2026-3432: Malicious code in @mistralai/mistralai (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.