Hostile 100% javascript Download

@squawk/notams 0.3.7

Obfuscated credential stealer in preinstall

Mini Shai-Hulud setup.mjs preinstall Bun loaderpreinstall setup.mjs bootstraps Bun runtime
SHA-2569842fc16e991dbc8b7e86dc5f6e5c42e0fb3e7a242d0b8d20489f309006b5742
URLhttps://registry.npmjs.org/@squawk/notams/-/notams-0.3.7.tgz
MaleculeK₂(McLi)O₇(C₂Ca₃CoS₃As₄DyXe)H₆(Po₆Cm₁₆CrDb₁₅F₁₂Os₅)Md₃(InPa₇)

Also flagged by osv (MAL-2026-3451: Malicious code in @squawk/notams (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.