Local reference
Suspicious dependency
Inferred
Mal-ecule
O(Eu)H₅(Cm₃Db₃OsPoU)Md₂(Pa₄)
Referenced by 10 samples
- benign github.com-linode-manager-v0.0.0-20260423175524-24bffa092326.zip fetched
- hostile github.com-matrixhub-ai-matrixhub-v0.2.0-rc.2.zip fetched
- suspicious github.com-prefecthq-prefect-v0.0.0-20260615190629-f8a5040f4fcf.zip fetched
- benign github.com-railwayapp-railpack-go-v0.30.1.zip fetched
- benign github.com-cloudhut-kowl-v3.7.1-0.20260528112505-e6e17221ff08+incompatible.zip fetched
- benign github.com-Tangerg-lynx-models-ollama-v0.0.0-20260803155903-27c19e34521a.zip fetched
- benign antigravity-manager-bin-0.20.0-1.src.tar.gz fetched
- benign github.com-sahil87-run-kit-v3.14.4+incompatible.zip fetched
- hostile harbor-stremio-git-0.9.117.r770.g9cdf1d5c-1.src.tar.gz fetched
- benign github.com-neondatabase-examples-v0.0.0-20260801130810-06b3c0607146.zip fetched
Objectives
Micro-behaviors
notable severity, 90% confident.
data/db
Calls localStorage or sessionStorage getItem
notable severity, 85% confident.
data/serialize
Serializes an identifier as JSON
notable severity, 90% confident.
os/module
ESM side-effect-only package import
notable severity, 85% confident.
process/interpreter
Package script invokes a language interpreter
baseline severity, 80% confident.
data/source/syntax
Reads an array element into a variable
baseline severity, 82% confident.
data/string
Searches strings with includes or indexOf
baseline severity, 80% confident.
os/env
Access environment variables
Metadata
notable severity, 90% confident.
file
Several Base64-looking strings in source
notable severity, 90% confident.
package/manifest
Package declares TypeScript types entry
notable severity, 90% confident.
package/quality
Package declares TypeScript tooling
baseline severity, 95% confident.
build
Code bundled with Rolldown
baseline severity, 80% confident.
file/profile
Contains common English function words
baseline severity, 99% confident.
lang
TypeScript declaration file
baseline severity, 100% confident.
package
package.json defines a package version
20 of 29 traits shown
Identity
| SHA-256 | 50c764f2fb6a2daeb9dccc25499663338860c34a4da965bce3f7079de7cfa7e7 |
|---|---|
| Canonical SHA-256 | 01b574ccbce69d1ec9ed106d06843d283cbdc22724e0a35f72b8a4504b43df65 |
| Filename | [email protected] |
| Package | @tanstack/react-router |
| Version | 1.170.27 |
| PURL | pkg:npm/@tanstack/[email protected] |
Origin
| Source | x |
|---|---|
| Feed | pkg.go.dev |
| Ecosystem | javascript |
| Domain | npmjs.org |
| URL | https://registry.npmjs.org/@tanstack/react-router/-/react-router-1.170.27.tgz |
Timeline
| First seen | 12 Aug 2026 06:26 UTC |
|---|---|
| First analyzed | 12 Aug 2026 06:28 UTC |
| Last analyzed | 14 Aug 2026 10:14 UTC |
| Last updated | 14 Aug 2026 10:13 UTC |
Labeling
| Label | unknown |
|---|---|
| Traits version | 59a44 |
Not seeing what you expected? Let us know