Hostile 100% javascript Download

drop-events-on-property-plugin 0.0.2

JavaScript writes credential workflow wormGitHub Actions secret name recon
SHA-256becf4b7d4b6df0a7cf962943e1d2f5db76753df784d122b96392dbaf20c4a46a
URLhttps://registry.npmjs.org/drop-events-on-property-plugin/-/drop-events-on-property-plugin-0.0.2.tgz
MaleculeO₁₁(As₉S₁₀C₂Ca₃CoEuILaDy₄PXe₄)H₅(Os₃Po₈Cm₆Db₅F)Md₂(Pa₃In)

Also flagged by osv (MAL-2025-191394: Malicious code in drop-events-on-property-plugin (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.