discovered 2026-08-04
Cacheable HTTP request library (33M weekly downloads). Unpublished from npm, still on npmmirror. Compromised via jaredwray account. Variant A payload.
