Hostile 92% javascript Download

schoolwork 1.0.0

Trojanized npm phishing facade

“security holding package”

Fresh HTML-only npm 1.0.0 package used as phishing facadeBrand-new HTML-only npm package with no keywords
SHA-256612b96afffc1cb15badd290deff2e5aa5e0cc0e0e3522ec388b225cd1b430be7
URLhttps://archive.softwareheritage.org/swh:1:dir:3073552b32bec23117f3f69f41c5cb0b3a532ed7
MaleculeO(S₃)Md(Pa₂)

Also flagged by osv (MAL-2026-14465: Malicious code in schoolwork (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.