Hostile 100% javascript Download

@posthog/zendesk-plugin 0.0.8

JavaScript writes credential workflow wormGitHub Actions secret name recon
SHA-2562fffc2ebcd5057134166dc8f56e2e95e38d8698260ea50e0219fe41c0a377518
URLhttps://registry.npmjs.org/@posthog/zendesk-plugin/-/zendesk-plugin-0.0.8.tgz
MaleculeO₁₁(As₉S₁₀C₂Ca₃CoEuILaDy₄PXe₄)H₅(Os₃Po₈Cm₆Db₅F)Md₂(Pa₃In)

Also flagged by osv (MAL-2025-191300: Malicious code in @posthog/zendesk-plugin (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.