Hostile 100% javascript Download

@squawk/flight-math 0.5.6

Obfuscated credential stealer in preinstall

Kubernetes token pivots through cloud metadataMini Shai-Hulud setup.mjs preinstall Bun loader
SHA-2567abf0fd786c7c78ccb35b5f6be3509abbdfb879d26e43e14b431d3790a727afc
URLhttps://registry.npmjs.org/@squawk/flight-math/-/flight-math-0.5.6.tgz
MaleculeK₂(McLi)O₆(C₂Ca₃CoLaS₄As₅)H₇(Po₇Cm₂₃Cr₃Db₁₉F₁₂Os₇Ti)Md₃(InPa₈)Th

Also flagged by osv (MAL-2026-3443: Malicious code in @squawk/flight-math (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.