Hostile 100% javascript Download

@pergel/module-ui 0.0.9

JavaScript writes credential workflow wormGitHub Actions secret name recon
SHA-2566f8e28e0e46a253475f55aae7c4d645379f2afc7f4a64f134ef797c706d4433b
URLhttps://registry.npmjs.org/@pergel/module-ui/-/module-ui-0.0.9.tgz
MaleculeO₁₁(As₉S₁₀C₂Ca₃CoEuILaDy₄PXe₄)H₅(Os₃Po₈Cm₆Db₅F)Md₂(Pa₃In)

Also flagged by osv (MAL-2025-191287: Malicious code in @pergel/module-ui (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.