Hostile 100% javascript Download

@operato/graphql 9.0.48

Exfiltrates secrets to webhook.site

Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)Downloads latest trufflehog release
SHA-256385da1cbb58eb9d65a502c995207639f5c7bee08b0bbeb6fcb88335b60aeb50f
URLhttps://registry.npmjs.org/@operato/graphql/-/graphql-9.0.48.tgz
MaleculeK(Li₄)O₅(Eu₂S₂AsCa₂I)H₇(BrCm₂₉Cr₄Db₁₉F₅Os₈Po₁₂)Md₂(Pa₈)Th

Also flagged by osv (MAL-2025-47255: Malicious code in @operato/graphql (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.