Hostile 100% javascript Download

intercom-client 7.0.4

Obfuscated dropper downloads and executes Bun

JavaScript downloads extracts and executes an archive runtimepreinstall setup.mjs bootstraps Bun runtime
SHA-2565f748fbc89cde66abefa826439c765a0081a027792e9da8d80fbf23571311622
URLhttps://registry.npmjs.org/intercom-client/-/intercom-client-7.0.4.tgz
MaleculeK(Li₄)O₆(C₂S₃As₅Ca₃DyXe)H₇(Po₆Cm₃₅Cr₃Db₁₈F₁₁Os₁₀U)Md₅(BkInPa₇V)

Also flagged by osv (MAL-2026-3204: Malicious code in intercom-client (npm)) +5 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.