Open-source atomic malware analysis

Analyze another

@vue/compiler-dom 3.3.4

UNKNOWN
Verdict: BENIGN
SHA256: 07bd17d3e1b046896121ec9c7f9e8ced32c21c02583ffac415ea6e5cb1076e04
“@vue/compiler-dom”
Mal-ecule
H₄(CmDb₂PoU)Md(Pa₃)
Size 161.9 KB download
First seen 16 days ago
Analyzed 6 days ago
Package pkg:npm/@vue/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 5 samples

Objectives

component severity, 90% confident.
command-and-control/channel/deaddrop Indexed content property access

Micro-behaviors

notable severity, 75% confident.
communications/http/url Contains a hardcoded remote HTTP(S) URL
notable severity, 92% confident.
data/control-flow CommonJS module re-exports required package
notable severity, 85% confident.
data/serialize Serializes an identifier as JSON
notable severity, 70% confident.
process/interpreter Calls JavaScript's new Function constructor
notable severity, 80% confident.
ui/window/manage Writes HTML into the DOM with innerHTML
baseline severity, 90% confident.
data/source/dynamic Immediate new Function invocation pattern
baseline severity, 80% confident.
data/source/syntax Reads an array element into a variable
component severity, 90% confident.
communications/url JavaScript comment contains a URL
component severity, 90% confident.
ui/window Browser selector targets textarea elements

Metadata

notable severity, 95% confident.
package/files JavaScript package file under the dist tree
notable severity, 95% confident.
package/manifest Package declares an unpkg CDN entry
baseline severity, 85% confident.
build JavaScript transpiler or minifier markers
baseline severity, 85% confident.
file High function density
baseline severity, 80% confident.
file/profile Contains common English function words
baseline severity, 100% confident.
lang javascript code embedded in string
baseline severity, 95% confident.
library Contains bundled or minified JavaScript
baseline severity, 100% confident.
package package.json defines a package version
baseline severity, 100% confident.
package/quality package.json defines a package name
component severity, 100% confident.
file/extension File uses a source declaration extension

20 of 21 traits shown

Identity

SHA-256 07bd17d3e1b046896121ec9c7f9e8ced32c21c02583ffac415ea6e5cb1076e04
Canonical SHA-256 022ebfa926279df3d7146854964c62e46dab8eb2504b577eaa04ef7a79780c8b
Filename [email protected]
Package @vue/compiler-dom
Version 3.3.4
PURL pkg:npm/@vue/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.3.4.tgz

Timeline

First seen 12 Aug 2026 12:12 UTC
First analyzed 12 Aug 2026 12:14 UTC
Last analyzed 22 Aug 2026 12:24 UTC
Last updated 22 Aug 2026 12:25 UTC

Labeling

Label unknown
Traits version 298c2