Open-source atomic malware analysis

Analyze another

package/lib/main.js

UNKNOWN
Verdict: SUSPICIOUS
SHA256: 5cc30e2db46bb70e043b5f7fdb2d526caa2a4fcf83806c1c08bd6f0a1559ef43
Mal-ecule
O₅(As₂C₂EuSCa)H₅(Cm₃CrPo₂Db₃F₂)
Size 11.8 KB download unavailable
First seen 73 days ago
Analyzed 73 days ago
Ecosystem javascript

Found in 1 archive

Objectives

hostile severity, 95% confident.
anti-static/obfuscation/payload Base64 decode + eval in same file
hostile severity, 99% confident.
command-and-control/dropper/delivery Axios Base64 URL payload eval loader
suspicious severity, 95% confident.
command-and-control/dropper/staging Decrypts hardcoded payload and executes it
suspicious severity, 95% confident.
exfiltration Sensitive file read and exfiltration (JS)
suspicious severity, 95% confident.
supply-chain/hidden-payload Obfuscated eval via buffer decode
notable severity, 75% confident.
anti-static/obfuscation/encoding Encoded HTTP URL
notable severity, 84% confident.
credential-access/env Node reads dotenv credential file contents

Micro-behaviors

suspicious severity, 90% confident.
communications/url Encoded URL decoded to https
suspicious severity, 90% confident.
crypto/symmetric/aes AES encryption combined with network
suspicious severity, 85% confident.
process/interpreter Base64 encoded URL (potential C2)
notable severity, 82% confident.
communications/http require('axios').get HTTP GET request
notable severity, 70% confident.
communications/http/lib axios require statement
notable severity, 90% confident.
data/decode JavaScript base64 decode via atob()
notable severity, 80% confident.
data/encode Nested hex and base64 decode
notable severity, 75% confident.
fs/file File content manipulation (read/write/seek)
baseline severity, 90% confident.
data/source Prototype guard keyword
baseline severity, 100% confident.
os/random/prng Math.random used for indexing (probabilistic character selection)

Metadata

baseline severity, 95% confident.
import imports axios
baseline severity, 95% confident.
lang JavaScript or TypeScript basename
baseline severity, 100% confident.
lang/encoded JavaScript file basename

20 of 50 traits shown

Identity

SHA-256 5cc30e2db46bb70e043b5f7fdb2d526caa2a4fcf83806c1c08bd6f0a1559ef43
Filename package/lib/main.js

Origin

Source harvest
Feed aikido.dev
Ecosystem javascript

Timeline

First seen 26 May 2026 05:50 UTC
First analyzed 26 May 2026 05:50 UTC
Last analyzed 26 May 2026 05:50 UTC
Last updated 26 May 2026 05:50 UTC

Labeling

Label bad
Label source harvest