Attachment: EML containing a base64 encoded script

type.inbound
and length(body.current_thread.text) < 1000
and any(attachments,
        (.content_type == "message/rfc822" or .file_extension == "eml")
        and strings.ilike(file.parse_eml(.).body.html.raw,
                          "*script*data:text/html;base64*"
        )
)
// exclude bounce backs & read receipts
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)
and not any(attachments, .content_type == "message/delivery-status")