sha256
a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86
discovered 2026-07-11
dist/intro.js binary payload container (7.8 MB). Byte-identical across all 5 compromised versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0). Custom binary format (magic \x1bCSI\x01) containing gzip-compressed Rust-compiled infostealers for Linux, Windows, and macOS.
