Open-source atomic malware analysis

Analyze another

rc-util 5.44.4

UNKNOWN
Verdict: BENIGN
SHA256: 5c5f9c9f78112ef0b8e18ad54f4f741a3cfb13198ffb5aceaf12e896d72e12cb
Mal-ecule
H₄(Cm₂Db₂PoU)Md(Pa₄)
Size 41.6 KB download
First seen 82 days ago
Analyzed 4 days ago
Package pkg:npm/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 5 samples

Micro-behaviors

notable severity, 75% confident.
communications/http Reads browser User-Agent string
notable severity, 90% confident.
communications/http/url References a public code-forge URL
notable severity, 90% confident.
data/control-flow JavaScript iterates enumerable object keys
notable severity, 90% confident.
data/format Markdown references a remote image
notable severity, 96% confident.
process/create AI agent permission bypass flag
notable severity, 80% confident.
ui/window/manage Removes a child node from the DOM
baseline severity, 80% confident.
data/source/syntax Reads an array element into a variable
baseline severity, 80% confident.
os/env Access environment variables

Metadata

notable severity, 90% confident.
package Package uses git hooks tooling
notable severity, 92% confident.
package/files Package.json declares a files allowlist
notable severity, 90% confident.
package/manifest Repository identifies major Git host
notable severity, 90% confident.
package/quality Package declares TypeScript tooling
baseline severity, 90% confident.
build Babel regenerator helper
baseline severity, 80% confident.
file/profile English function-word token "have"
baseline severity, 99% confident.
lang TypeScript declaration file
baseline severity, 95% confident.
library Contains bundled or minified JavaScript
baseline severity, 90% confident.
package/testing/harness Test, spec, or fixture file
baseline severity, 100% confident.
package/testing/presence File identified as a test by path or name
component severity, 100% confident.
file/extension File uses a source declaration extension

supply-chain

notable severity, 80% confident.
install-hook Package has 'prepare' hook that runs during install

20 of 25 traits shown

Identity

SHA-256 5c5f9c9f78112ef0b8e18ad54f4f741a3cfb13198ffb5aceaf12e896d72e12cb
Canonical SHA-256 052e23b3296b7246df0581db31c2516a0be26bcf2b70245dfde3ce6f2faa7d14
Filename rc-util-5.44.4.tgz
Package rc-util
Version 5.44.4
PURL pkg:npm/[email protected]

Origin

Source forager
Feed npmjs.org
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/rc-util/-/rc-util-5.44.4.tgz

Timeline

First seen 7 Jun 2026 20:17 UTC
First analyzed 7 Jun 2026 23:42 UTC
Last analyzed 24 Aug 2026 04:36 UTC
Last updated 24 Aug 2026 04:38 UTC

Labeling

Label good
Label source forager
Traits version 4092c