u/syco69

Got DMd with this. Are these guys legit? Are the prices decent? Cuz I’ve been wanting to buy losses to farm up merits.

Hi everyone,

I’m looking for a second opinion from people with more experience in malware analysis and npm supply-chain attacks.

I hired a freelance developer for a small feature. After only a couple of hours, he asked us to review his initial commit. During the review, my lead developer noticed a recently published npm package that seemed out of place. Digging further, we found that it pulls in another package from the same author containing heavily obfuscated code.

This is not my repository or package. It’s code that was submitted to me by a contractor. I’m only sharing it because I’m trying to determine whether we’re dealing with a legitimate dependency, AI-generated garbage, or an actual malicious supply-chain attack.

Our current observations:

• A newly published package with very few downloads was introduced.
• It appears to install another package from the same author.
• The transitive dependency contains heavily obfuscated JavaScript.
• The code appears to execute during package installation.
• We’ve already isolated the machine used for testing, removed the packages, and are rotating credentials out of caution.

It’s entirely possible we’re being overly cautious, so I’d appreciate experienced eyes on it.

Repository: https://github.com/ist89/backtesting-project

If anyone is willing to review the dependency chain or explain whether this is actually malicious (or just looks suspicious), I’d really appreciate it.

Thanks.