Hostile 100% javascript Download

@uipath/resourcecatalog-tool 0.1.1

Credential harvesting and obfuscation

preinstall setup.mjs bootstraps Bun runtimeGitHub/npm token regex harvesting
SHA-256fb2cd467e039aa1d8cd5b24e407f409c6142236e96d5a5ade47c40b2db7677db
URLhttps://registry.npmjs.org/@uipath/resourcecatalog-tool/-/resourcecatalog-tool-0.1.1.tgz
MaleculeK(Li)O₆(C₂Ca₃CoS₃As₄Dy)H₇(Po₁₇Cm₃₀CrDb₂₃F₁₄Os₉Ti)Md₆(InLiPa₄V)

Also flagged by osv (MAL-2026-3569: Malicious code in @uipath/resourcecatalog-tool (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.