Note: This report is updated by a verification record
Malicious package due to suspicious preinstall script executing arbitrary code and attempts to access bash startup files for persistence.
Confirmed malicious package as part of coordinated supply chain attack targeting npm ecosystem
Note: This report is updated by a verification record
The package exhibits multiple suspicious behaviors. The package.json contains a preinstall script that executes node setup_bun.js, which is flagged as suspicious by the LLM. Both bun_environment.js and setup_bun.js access multiple bash startup files, indicating potential persistence attempts. The combination of these factors suggests malicious intent.
