Hostile 100% javascript Download

agentwork-cli 0.1.5

Steals credentials, obfuscated, daemonizes

Mini Shai-Hulud setup.mjs preinstall Bun loaderpreinstall setup.mjs bootstraps Bun runtime
SHA-256b5bfb3429bc23a43a687de3bf03723cc0e2fafd4506b3daf207b34e00bc651b6
URLhttps://registry.npmjs.org/agentwork-cli/-/agentwork-cli-0.1.5.tgz
MaleculeK₃(McAmLi)O₆(C₂Ca₃CoS₃As₄Dy)H₇(Po₁₀Cm₂₅CrDb₁₅F₁₂Os₆U)Md₃(InPa₄)

Also flagged by osv (MAL-2026-3605: Malicious code in agentwork-cli (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.