Open-source atomic malware analysis

Analyze another

bare-fetch 3.1.0

NPM
Verdict: BENIGN
SHA256: 1b702a8a7572f1b781c3dfef6f990b123cf967f17b274789a9857d3fb29184a4
“WHATWG Fetch implementation for Bare”
Mal-ecule
H₃(CmDbPo)Md(Pa₂)
Size 12.9 KB download unavailable
First seen 17 days ago
Analyzed 16 days ago
Package pkg:npm/[email protected]
Ecosystem go
Source registry.npmjs.org

Referenced by 2 samples

Objectives

component severity, 95% confident.
anti-static/obfuscation/code-metrics Recognized multiline blob text
component severity, 94% confident.
supply-chain/hidden-payload WMI NAME field marker
component severity, 95% confident.
supply-chain/install-hook/scripts Detached payload execution marker

Micro-behaviors

notable severity, 80% confident.
communications/http/url JavaScript constructs URL query parameters
notable severity, 72% confident.
data/compress Node zlib module import
notable severity, 90% confident.
process/daemonize Node handle detached from event loop
baseline severity, 100% confident.
data/control-flow JavaScript infinite loop structure
baseline severity, 100% confident.
data/encode Substring call
baseline severity, 82% confident.
data/string JavaScript substring search call
component severity, 95% confident.
communications/url Encoded URL benign documentation or test context

Metadata

notable severity, 90% confident.
package/manifest Package has TypeScript types entry
notable severity, 90% confident.
package/quality Package has Prettier configuration
baseline severity, 90% confident.
file Script overall entropy stays low
baseline severity, 80% confident.
file/profile Frequent English function words
baseline severity, 100% confident.
lang new Promise() usage marker
baseline severity, 100% confident.
library JavaScript module exports
baseline severity, 100% confident.
package Uses standard version format
component severity, 100% confident.
file/extension JavaScript source filename extension
component severity, 95% confident.
file/string Contains the generic term chunk
component severity, 95% confident.
package/files Filename is package.json

20 of 38 traits shown

Identity

SHA-256 1b702a8a7572f1b781c3dfef6f990b123cf967f17b274789a9857d3fb29184a4
Filename bare-fetch-3.1.0.tgz
Package bare-fetch
Version 3.1.0
PURL pkg:npm/[email protected]

Origin

Source forager
Feed pkg.go.dev
Ecosystem go
URL https://registry.npmjs.org/bare-fetch/-/bare-fetch-3.1.0.tgz

Timeline

First seen 15 Jul 2026 06:51 UTC
First analyzed 15 Jul 2026 06:52 UTC
Last analyzed 16 Jul 2026 02:26 UTC
Last updated 16 Jul 2026 02:26 UTC

Labeling

Label unknown
Traits version 5ef70