Hostile 92% javascript Download

@things-factory/attachment-base 9.0.43

Embedded secret exfiltration script

Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)Downloads latest trufflehog release
SHA-25619445b925e82bc467c30a848a3342611f5d8213ac2ff20c110f4b7c837561c9f
URLhttps://registry.npmjs.org/@things-factory/attachment-base/-/attachment-base-9.0.43.tgz
MaleculeK(Li₄)O₅(Eu₂S₂AsCa₂I)H₆(Cm₃₁Cr₄Db₂₀F₆Os₈Po₁₄)Md₃(InPa₅)Th

Also flagged by osv (MAL-2025-47282: Malicious code in @things-factory/attachment-base (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.