Hostile 100% javascript Download

@squawk/procedure-data 0.7.5

Obfuscated credential stealer with install hook dropper

Kubernetes token pivots through cloud metadatapreinstall setup.mjs bootstraps Bun runtime
SHA-25613707cd70c630426bfc7e2e6e3782249f7b6304a35181379ba60c06a9b3c4857
URLhttps://registry.npmjs.org/@squawk/procedure-data/-/procedure-data-0.7.5.tgz
MaleculeK(Li)O₆(C₂Ca₃CoLaS₄As₄)H₇(Po₇Cm₂₄Cr₃Db₁₉F₁₂Os₇Ti)Md₄(BkInPa₈)Th

Also flagged by osv (MAL-2026-3452: Malicious code in @squawk/procedure-data (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.