Open-source atomic malware analysis

Analyze another

@authagonal/bff

NPM
Verdict: SUSPICIOUS
“Backend-for-Frontend for SPAs using Authagonal. Runs the OIDC auth-code + PKCE flow server-side, holds tokens in a server-side session, and…”
AI New package, suspected publisher takeover
Mal-ecule
H₃(Cm₈Cr₂Db₆)Md(Pa₃)
Size 28.6 KB download
First seen 1 day ago
Analyzed 1 day ago
Package pkg:npm/%40authagonal/bff
Ecosystem javascript

Loading file contents…

Loading traits…

Identity

SHA-256 328d4000d9dbb63592601c94ec399d703796eee857fff426dea2922774f563ff
Canonical SHA-256 10048ea825b99fd575dab7d0b32265ad99365c8c219a357a8daa37f8a934d8db
Filename @authagonal-bff-0.10.12.tgz
Package @authagonal/bff
PURL pkg:npm/%40authagonal/bff

Origin

Source forager
Feed npmjs.org
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/@authagonal/bff/-/bff-0.10.12.tgz

Timeline

First seen 21 Jul 2026 10:17 UTC
First analyzed 21 Jul 2026 10:43 UTC
Last analyzed 21 Jul 2026 10:43 UTC
Last updated 21 Jul 2026 10:43 UTC

Labeling

Label unknown
Label source forager
Traits version 16794