Open-source atomic malware analysis

Analyze another

superagent 5.3.1

UNKNOWN
Verdict: BENIGN
SHA256: 5bc51d3793c863fd6b5b69414ebbaeb67d8d80341f5cec357bd252eec21f6fc2
“elegant & feature rich browser / node HTTP with a fluent API”
Mal-ecule
H₆(Cm₂₀Db₁₀F₂Os₃Po₂U)Md₄(InPa₆)
Size 187.1 KB download
First seen 6 days ago
Analyzed 6 days ago
Package pkg:npm/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 1 sample

Micro-behaviors

notable severity, 94% confident.
communications/http Reads redirect target from response object
notable severity, 90% confident.
communications/http/client References an XMLHTTP COM client
notable severity, 95% confident.
communications/http/header Requests a JSON HTTP response
notable severity, 95% confident.
communications/http/url Upload, backup, or exfil URL path
notable severity, 95% confident.
communications/ip Contains an external-IP HTTP URL
notable severity, 90% confident.
communications/socket Node TLS verification disabled via environment
notable severity, 92% confident.
data/control-flow JavaScript empty named-parameter catch
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 90% confident.
data/source Calls a member params method
notable severity, 90% confident.
fs/write/file Writes a buffer argument to a stream
notable severity, 90% confident.
os/com Creates legacy ActiveX HTTP object
notable severity, 90% confident.
process/fd Pipes a Node response stream
notable severity, 100% confident.
process/interpreter ActiveXObject constructor reference
notable severity, 95% confident.
ui/window Assigns a FileList between browser file inputs

Metadata

notable severity, 90% confident.
encoded-payload Encoded payload detected: base64
notable severity, 100% confident.
file/format JavaScript source map
notable severity, 90% confident.
package Package uses git hooks tooling
notable severity, 95% confident.
package/files JavaScript package file under the dist tree
notable severity, 95% confident.
package/manifest Package declares a jsDelivr CDN entry
notable severity, 90% confident.
package/quality Package has Prettier configuration

20 of 40 traits shown

Identity

SHA-256 5bc51d3793c863fd6b5b69414ebbaeb67d8d80341f5cec357bd252eec21f6fc2
Filename [email protected]
Package superagent
Version 5.3.1
PURL pkg:npm/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/superagent/-/superagent-5.3.1.tgz

Timeline

First seen 24 Aug 2026 02:00 UTC
First analyzed 24 Aug 2026 02:00 UTC
Last analyzed 24 Aug 2026 02:08 UTC
Last updated 28 Aug 2026 02:05 UTC

Labeling

Label unknown