Hostile 100% javascript Download

leo-cli 3.0.3

binding.gyp executes arbitrary code at install

binding.gyp runs a command at install timeCloud provider credential file paths
SHA-2563da2ca129c9920d9acd2e3477aee8f46b5a5f0e9537ad6e7b6ab1df1007adad1
URLhttps://registry.npmjs.org/leo-cli/-/leo-cli-3.0.3.tgz
MaleculeO₇(S₄C₃IAsCaCoXe)H₅(F₄Cm₅Db₂OsPo₇)Md₃(InLiPa₇)

Also flagged by osv (MAL-2026-6421: Malicious code in leo-cli (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.