Hostile 100% javascript Download

@zapier/browserslist-config-zapier 1.0.5

JavaScript writes credential workflow wormGitHub Actions secret name recon
SHA-256b3c4ebc98598409b04225e09bf62b79e38901384118635ec1bc946ac66ce55f1
URLhttps://registry.npmjs.org/@zapier/browserslist-config-zapier/-/browserslist-config-zapier-1.0.5.tgz
MaleculeO₁₁(As₉S₁₀C₂Ca₃CoEuILaDy₄PXe₄)H₅(Os₃Po₈Cm₆Db₅F)Md₂(Pa₃In)

Also flagged by osv (MAL-2025-190762: Malicious code in @zapier/browserslist-config-zapier (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.