Hostile 100% javascript Download

@redhat-cloud-services/insights-client 4.0.5

preinstall executes obfuscated payload

Megabyte charcode-packed payload feeds direct evalPreinstall executes obfuscated bundled eval dropper
SHA-2564bf96a529a21ef0da04cfed904f369ee16988c6c105cc0c9c7057235279ed784
URLhttps://registry.npmjs.org/@redhat-cloud-services/insights-client/-/insights-client-4.0.5.tgz
MaleculeO₃(As₃S₄Co)H₄(Cm₃Db₄OsPo₂)Md(Pa₃)

Also flagged by osv (MAL-2026-5142: Malicious code in @redhat-cloud-services/insights-client (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.