Hostile 100% javascript Download

@tolka/cli 1.0.2

preinstall setup.mjs bootstraps Bun runtimeGitHub/npm token regex harvesting
SHA-2567482841f251fdca7cc3bc10bfa27f5bbd037744ae2863d9152cffa21dd5553c6
URLhttps://registry.npmjs.org/@tolka/cli/-/cli-1.0.2.tgz
MaleculeK(Li)O₆(C₂Ca₃CoS₃As₄Dy)H₈(Po₁₀Cm₂₂CrDb₁₆F₁₂HfOs₈U)Md₄(InLiPa₃)

Also flagged by osv (MAL-2026-3521: Malicious code in @tolka/cli (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.