Hostile 100% javascript Download

@tallyui/pos 0.1.2

Obfuscated credential stealer payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderpreinstall setup.mjs bootstraps Bun runtime
SHA-256fd2037c03e88caabe1a5d2310e62ef6e98766be99fdde8a4abb0a50f8e74b264
URLhttps://registry.npmjs.org/@tallyui/pos/-/pos-0.1.2.tgz
MaleculeK₂(McLi₂)O₇(C₂Ca₃CoS₃As₄DyXe)H₆(Po₆Cm₁₆CrDb₁₅F₁₂Os₅)Md₃(InPa₆)

Also flagged by osv (MAL-2026-3459: Malicious code in @tallyui/pos (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.