Hostile 100% javascript Download

@zapier/stubtree 0.1.3

JavaScript writes credential workflow wormGitHub Actions secret name recon
SHA-2561fccf75c51afd6357a133e4180d3769737c4310f73c57a0d9d1a75d70281bc89
URLhttps://registry.npmjs.org/@zapier/stubtree/-/stubtree-0.1.3.tgz
MaleculeO₁₂(As₉S₁₀C₃Ca₄CoEuI₂LaDy₄PPrXe₄)H₅(Os₄Po₉Cm₆Db₅F₂)Md₂(Pa₇In)

Also flagged by osv (MAL-2025-190920: Malicious code in @zapier/stubtree (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.