Hostile 100% javascript Download

date-fns-scripts 9.9.9

Mature hollow package advertises default index entrynpm package has empty description
SHA-256f9321cc77f4c92dba28ba22ccd12ba68b017b4d9838971b922fdbada93fff422
URLhttps://registry.npmjs.org/date-fns-scripts/-/date-fns-scripts-9.9.9.tgz
MaleculeO(S₂)Md(Pa₃)

Also flagged by osv (MAL-2026-1704: Malicious code in date-fns-scripts (npm)).

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.