Hostile 100% javascript Download

@nx/enterprise-cloud 3.2.0

postinstall exfiltrates credentials, sabotages system

Appends a power command to a shell profileHarvested environment pushed to a GitHub repo
SHA-25695ec8308a262fb9d3ebe3b45e96eb2c4850097a098f0c9d8b6e6684841285d7e
URLhttps://registry.npmjs.org/@nx/enterprise-cloud/-/enterprise-cloud-3.2.0.tgz
MaleculeK₂(McLu)O₁₀(EuIP₂S₆As₅Ca₄AlCErXe)H₇(Po₁₂Cm₁₁CrDb₁₂F₁₀Os₈Ti)Md₃(InPa₈)Th

Also flagged by osv (MAL-2025-41437: Malicious code in @nx/enterprise-cloud (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.