Hostile 100% javascript Download

get-them-args 1.3.3

JavaScript writes credential workflow wormGitHub Actions secret name recon
SHA-25639c3d4c2c0e71b24f9c66a7992c3c3ecd03c8c1518c637b9e54499ed9e54c63b
URLhttps://registry.npmjs.org/get-them-args/-/get-them-args-1.3.3.tgz
MaleculeO₁₁(As₉S₁₀C₂Ca₃CoEuILaDy₄PXe₄)H₅(Os₃Po₈Cm₆Db₅F)Md₂(Pa₃In)

Also flagged by osv (MAL-2025-191103: Malicious code in get-them-args (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.