Hostile 100% javascript Download

@tallyui/core 0.2.1

Credential stealer with obfuscation

Mini Shai-Hulud setup.mjs preinstall Bun loaderpreinstall setup.mjs bootstraps Bun runtime
SHA-256d08035a1e295447ca70f93adead95ea543969b64c7245e27f5103b69adef1863
URLhttps://registry.npmjs.org/@tallyui/core/-/core-0.2.1.tgz
MaleculeK₂(McLi₂)O₆(C₂Ca₃CoS₃As₄Dy)H₆(Po₆Cm₁₉CrDb₁₄F₁₁Os₆)Md₃(InPa₅)

Also flagged by osv (MAL-2026-3603: Malicious code in @tallyui/core (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.