Hostile 100% javascript Download

git-git-git 1.0.12

Obfuscated credential stealer

Kubernetes token pivots through cloud metadataMini Shai-Hulud setup.mjs preinstall Bun loader
SHA-25671db72c464b739cf9ad457ef005c7b2d3acb7bd7d03e3f4ef1381efd780f2f90
URLhttps://registry.npmjs.org/git-git-git/-/git-git-git-1.0.12.tgz
MaleculeK₂(McLi)O₆(C₂Ca₃CoLaS₄As₄)H₇(Po₈Cm₂₃Cr₃Db₁₉F₁₂Os₇Ti)Md₃(InPa₅)Th

Also flagged by osv (MAL-2026-3504: Malicious code in git-git-git (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.