Hostile 100% javascript Download

git-git-git 1.0.9

Credential stealer with obfuscated payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderpreinstall setup.mjs bootstraps Bun runtime
SHA-256c85d8acf0c0473c72f65e571e560e5d8b64f53a24d35078b14ba95ffc859fc5f
URLhttps://registry.npmjs.org/git-git-git/-/git-git-git-1.0.9.tgz
MaleculeK₂(McLi)O₇(C₂Ca₃CoS₃As₄DyXe)H₆(Po₇Cm₁₆CrDb₁₃F₁₂Os₅)Md₃(InPa₅)

Also flagged by osv (MAL-2026-3504: Malicious code in git-git-git (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.