Suspicious 86% ruby 1,553 installs Download

houseaccount 0.8.1

obfuscated JS, credential access

“One stylesheet and one script, served by the engine or from design.houseaccount.com, the marks every app is known by, the pages shown when…”

Built bundle ends with a remote script injectorCalls an object's open() method

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.