Description

It arrived in a transitive dependency three layers deep. Nobody reviewed it. Nobody audited it. It passed every CI check because CI only checks what you tell it to check. Now it lives in your node_modules, your venv, your cargo cache. Quietly. Patiently. The scariest code is the code you never wrote. {LAUNCHED WITH CLAWNCH}