Hostile 100% javascript Download

keyv 6.0.0

Obfuscated preinstall payload executes code

Obfuscated JavaScript targets AWS and GitHub runner credentialsPreinstall executes obfuscated bundled eval dropper
SHA-256d584f9b6af48b7ed1f93713944f033783bf149e1c25e1643eb8c0e9df5dc7782
URLhttps://registry.npmjs.org/keyv/-/keyv-6.0.0.tgz
MaleculeK(Li)O₄(CaS₄As₃Xe)H₅(CrDb₈FOsPo₄)Md₂(InPa₅)

Also flagged by https://safedep.io/rss.xml (Introducing SafeDep Threat Intel), https://www.aikido.dev/blog/rss.xml (The dark figure of supply chain detection), osv (MAL-2026-11524: Malicious code in keyv (npm)) +5 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.