discovered 2026-08-04
Flat cache library (149M weekly downloads). Unpublished from npm, still on npmmirror. Compromised via jaredwray account. Variant A payload.
