Hostile 92% javascript Download

@operato/pull-to-refresh 9.0.44

Exfiltrates secrets to webhook.site

Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)Downloads latest trufflehog release
SHA-256dde6ad6f4f197978284a9c74ebbedd713c0748d2a20f5b7d1968fb8572f89161
URLhttps://registry.npmjs.org/@operato/pull-to-refresh/-/pull-to-refresh-9.0.44.tgz
MaleculeK(Li₄)O₅(Eu₂S₃AsCa₂I)H₈(Cm₂₉Cr₄Db₁₉F₅HfOs₉Po₁₂U)Md₂(Pa₇)Th

Also flagged by osv (MAL-2025-47261: Malicious code in @operato/pull-to-refresh (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.