Hostile 92% javascript Download

@things-factory/env 9.0.45

Exfiltrates secrets to webhook.site

Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)Downloads latest trufflehog release
SHA-2566ebf806d416f3ea2071b034cd8ea3d1399199db33a01344bee5d8f5bd0cea14d
URLhttps://registry.npmjs.org/@things-factory/env/-/env-9.0.45.tgz
MaleculeK(Li₄)O₅(Eu₂S₂AsCa₂I)H₆(Cm₂₉Cr₄Db₂₁F₆Os₁₁Po₁₂)Md₂(Pa₆)Th

Also flagged by osv (MAL-2025-47222: Malicious code in @things-factory/env (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.