The package is not a malware. The high_fetch_command_val rule match in build.yml is likely a legitimate use in CI/CD workflow.
No verification record available.
The YARA rule high_fetch_command_val matched the build.yml file. This rule detects potentially malicious behavior like downloading and executing binaries. In this case, the workflow downloads tparse from GitHub and makes it executable. While downloading and executing binaries can be risky, it's a common practice in CI/CD workflows for installing necessary tools. Given the project's relatively high star and fork count (8922 stars, 426 forks), it is more likely a legitimate use case rather than malicious activity. There is only one YARA rule match.
