Open-source atomic malware analysis

Analyze another

postinstall.js

JAVASCRIPT
Verdict: HOSTILE
SHA256: 24cfb439f15e37cd284858930720a15dfdd2af45a15f86a2226f6920d0767f00
Mal-ecule
KO₂(S₄As₁₁)H₂(Po₃Cm)Md(Pa₂)
Size 186.0 KB download
First seen 118 days ago
Analyzed 117 days ago
Ecosystem malcontent-samples

Well-known

baseline severity, 100% confident.
tool/sysadmin Uses sed for text processing
component severity, 90% confident.
malware/dropper/nemucod File has 20k character line

Objectives

hostile severity, 98% confident.
supply-chain/install-hook Obfuscated npm postinstall hidden shell dropper
notable severity, 85% confident.
anti-static/obfuscation High ratio of digit characters (junk padding)
notable severity, 75% confident.
anti-static/obfuscation/code-metrics Many numeric suffix identifiers (var1,
notable severity, 77% confident.
anti-static/obfuscation/encoding Hexadecimal string concatenation
notable severity, 90% confident.
anti-static/obfuscation/string Dense hex escape count
notable severity, 90% confident.
anti-static/obfuscation/tools Hex-prefixed function names (_0x pattern)
component severity, 100% confident.
supply-chain/hidden-payload hex encoding string
component severity, 100% confident.
supply-chain/trojanized/library require fs

Micro-behaviors

notable severity, 90% confident.
process/create shell option via obfuscated alias
notable severity, 90% confident.
process/create/shell execSync destructured require alias
baseline severity, 70% confident.
data/source/syntax Function constructor keyword
baseline severity, 78% confident.
fs/directory Obfuscated Node Dirent method calls

Metadata

baseline severity, 90% confident.
encoded-payload Decoded unicode-escape content
baseline severity, 80% confident.
file/text High non-ASCII ratio in source
baseline severity, 70% confident.
import require('fs') import
baseline severity, 100% confident.
lang new Promise() usage marker
baseline severity, 100% confident.
lang/encoded JavaScript file basename
baseline severity, 95% confident.
library Large bundled JavaScript graph

20 of 22 traits shown

Identity

SHA-256 24cfb439f15e37cd284858930720a15dfdd2af45a15f86a2226f6920d0767f00
Filename postinstall.js

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 25 Apr 2026 23:14 UTC
Last updated 25 Apr 2026 23:14 UTC

Labeling

Label bad
Label source harvest
Traits version bf48d