Hostile 100% javascript Download

@ensdomains/unicode-confusables 0.1.1

JavaScript writes credential workflow wormGitHub Actions secret name recon
SHA-25668e631f24a85b361721e8a735906ed9932b131f8b4b51e703463eddb2e27c763
URLhttps://registry.npmjs.org/@ensdomains/unicode-confusables/-/unicode-confusables-0.1.1.tgz
MaleculeO₁₁(As₉S₁₀C₂Ca₃CoEuILaDy₄PXe₄)H₅(Os₃Po₈Cm₆Db₅F)Md₂(Pa₃In)

Also flagged by osv (MAL-2025-190740: Malicious code in @ensdomains/unicode-confusables (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.