It's been taken down, but here's what the malicious payload inside electron-native-notify looked like: https://gist.github.com/ievans/7e10101cadb823583f77a5d40c64e...