discovered 2026-08-04
File entry cache library (147M weekly downloads). Compromised via jaredwray account. Variant A payload.