Hostile 100% javascript Download

git-git-git 1.0.10

preinstall downloads and executes obfuscated stealer

Mini Shai-Hulud setup.mjs preinstall Bun loaderpreinstall setup.mjs bootstraps Bun runtime
SHA-25658c4892786129f2737631f886b266fbd4c81e3c96b914d3e2b848f09062735c1
URLhttps://registry.npmjs.org/git-git-git/-/git-git-git-1.0.10.tgz
MaleculeK₂(McLi)O₇(C₂Ca₃CoS₃As₄DyXe)H₆(Po₇Cm₁₆CrDb₁₃F₁₂Os₅)Md₃(InPa₅)

Also flagged by osv (MAL-2026-3504: Malicious code in git-git-git (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.