Hostile 100% javascript Download

gulp-inject-envs 1.2.2

JavaScript writes credential workflow wormGitHub Actions secret name recon
SHA-2562f2a9fe84d51908336d1c5cc0c0680ce2c2b568206d8b711d10c2efd4ed3407a
URLhttps://registry.npmjs.org/gulp-inject-envs/-/gulp-inject-envs-1.2.2.tgz
MaleculeO₁₁(As₉S₁₀C₂Ca₃CoEuILaDy₄PXe₄)H₅(Os₃Po₈Cm₆Db₅F)Md₂(Pa₃In)

Also flagged by osv (MAL-2025-191105: Malicious code in gulp-inject-envs (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.