Local reference
Suspicious dependency
Inferred
Mal-ecule
O(S)H₂(CmPo)Md(Pa₂)
Referenced by 1 sample
Objectives
notable severity, 85% confident.
supply-chain/install-hook/package
Mature version package with incomplete copied metadata
component severity, 95% confident.
supply-chain/install-hook/scripts
prepare runs package-manager build
Micro-behaviors
notable severity, 90% confident.
communications/http/url
References a public code-forge URL
notable severity, 85% confident.
process/hook
fetch API hooking
baseline severity, 80% confident.
data/source/syntax
Reads an array element into a variable
component severity, 93% confident.
communications/http
Repeating timer marker
component severity, 90% confident.
communications/url
JavaScript comment contains a URL
component severity, 86% confident.
data/control-flow
Starts a synchronous function expression
component severity, 90% confident.
data/serialize
JSON-like object result field
Metadata
notable severity, 90% confident.
package/manifest
Repository uses owner/project coordinate
baseline severity, 90% confident.
build
Babel class-call-check helper
baseline severity, 90% confident.
file
Source file has low overall entropy
baseline severity, 80% confident.
file/profile
Contains common English function words
baseline severity, 100% confident.
package
package.json defines a package version
baseline severity, 90% confident.
package/dependencies
npm manifest declares no runtime dependencies
baseline severity, 100% confident.
package/quality
package.json defines a package name
component severity, 100% confident.
file/extension
JavaScript source filename extension
supply-chain
notable severity, 80% confident.
install-hook
Package has 'prepare' hook that runs during install
Identity
| SHA-256 | 083d83b4099c9a5c5eaabe42abaf00eea6bf7cf611ba0616a9ab4109a96fbc82 |
|---|---|
| Filename | pkg:npm/[email protected] |
Origin
| Source | x |
|---|---|
| Feed | pkg.go.dev |
| Ecosystem | go |
Timeline
| First seen | 17 Aug 2026 01:02 UTC |
|---|---|
| First analyzed | 17 Aug 2026 01:02 UTC |
| Last analyzed | 17 Aug 2026 01:22 UTC |
| Last updated | 17 Aug 2026 01:21 UTC |
Labeling
| Label | unknown |
|---|
Not seeing what you expected? Let us know