Open-source atomic malware analysis

Analyze another

@parcel/watcher 2.0.4

UNKNOWN
Verdict: BENIGN
SHA256: 2b871dcfd77b309fa69e767fb35994a59c427fc4ca7948ddd267ca9d258f63c5
“A native C++ Node module for querying and subscribing to filesystem events. Used by Parcel 2.”
Mal-ecule
K(Li)O(As)H₇(Cm₅DbDsF₆MgOs₃Po₇)Md₃(Bi₄Pa₅Si₃)
Size 762.2 KB download
First seen 14 days ago
Analyzed 2 days ago
Package pkg:npm/@parcel/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 10 samples

Well-known

notable severity, 98% confident.
lib/platform @parcel/watcher npm package name

Objectives

notable severity, 94% confident.
anti-static/obfuscation/string LoadLibraryExA name without IAT import

Micro-behaviors

notable severity, 100% confident.
communications/ipc Uses named pipe IPC APIs
notable severity, 95% confident.
communications/socket Imports POSIX socket creation API
notable severity, 90% confident.
data/string Native buffer comparison call
notable severity, 90% confident.
dylib dlsym function symbol
notable severity, 92% confident.
fs/enumerate Directory walker using Win32 find APIs
notable severity, 94% confident.
fs/file FILE_FLAG_BACKUP_SEMANTICS open flag
notable severity, 90% confident.
fs/watch ReadDirectoryChangesW directory monitoring
notable severity, 95% confident.
mem/protect Modify memory page protection
notable severity, 90% confident.
os/env Accesses the x64 process environment block
notable severity, 94% confident.
os/kernel Advance directory entry buffer by offset
notable severity, 95% confident.
process/create Imports C popen command-pipe API
notable severity, 95% confident.
process/create/shell C popen command execution

Metadata

notable severity, 95% confident.
binary PE has no signature record
notable severity, 100% confident.
binary/linking ELF depends on glibc
notable severity, 90% confident.
binary/metrics 4+ functions with 50+ block control-flow graphs
notable severity, 95% confident.
package Install hook builds a Node native addon
notable severity, 92% confident.
package/files Package.json declares a files allowlist
notable severity, 100% confident.
signed Ad-hoc Signature

20 of 44 traits shown

Identity

SHA-256 2b871dcfd77b309fa69e767fb35994a59c427fc4ca7948ddd267ca9d258f63c5
Canonical SHA-256 16e1424235d798e7a16e3ad054ae0b26ea0f6b461861737e9d6235c531ea82b7
Filename [email protected]
Package @parcel/watcher
Version 2.0.4
PURL pkg:npm/@parcel/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/@parcel/watcher/-/watcher-2.0.4.tgz

Timeline

First seen 12 Aug 2026 02:28 UTC
First analyzed 12 Aug 2026 02:29 UTC
Last analyzed 24 Aug 2026 10:20 UTC
Last updated 24 Aug 2026 10:21 UTC

Labeling

Label unknown
Traits version b8c1c