Hostile 100% javascript Download

@squawk/airport-data 0.7.7

Obfuscated credential stealer via preinstall

Kubernetes token pivots through cloud metadatapreinstall setup.mjs bootstraps Bun runtime
SHA-25639cbe057c5df9943baa91d280f44937d838312a3c061000d6132babd063922a3
URLhttps://registry.npmjs.org/@squawk/airport-data/-/airport-data-0.7.7.tgz
MaleculeK(Li)O₆(C₂Ca₃CoLaS₄As₄)H₇(Po₇Cm₂₄Cr₃Db₁₉F₁₂Os₇Ti)Md₄(BkInPa₈)Th

Also flagged by osv (MAL-2026-3435: Malicious code in @squawk/airport-data (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.