Hostile 100% javascript Download

@tallyui/components 1.0.1

Credential stealer with obfuscation

Mini Shai-Hulud setup.mjs preinstall Bun loaderpreinstall setup.mjs bootstraps Bun runtime
SHA-256895fe662adb4320216545599dd020ababe776d8e63f0c833139ad7c3221c5c79
URLhttps://registry.npmjs.org/@tallyui/components/-/components-1.0.1.tgz
MaleculeK₂(McLi₂)O₆(C₂Ca₃CoS₃As₄Dy)H₇(Po₆Cm₁₉CrDb₁₃F₁₁Os₆U)Md₃(InPa₅)

Also flagged by osv (MAL-2026-3514: Malicious code in @tallyui/components (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.