Threats Tagged 'mal-2026-5790'

The ldpbootstrap-jquery npm package contains malicious code that executes an obfuscated Windows PowerShell payload. This payload is decrypted and run with execution policy bypass and hidden window settings, explicitly designed to evade antivirus detection. The package also fetches additional PowerShell scripts over unencrypted HTTP, which are executed in the same stealthy manner. Although the malicious code does not run automatically on installation, any developer using the package as documented will execute attacker-controlled PowerShell code on Windows systems. This behavior constitutes malware distribution infrastructure and results in full compromise of affected systems.