Open-source atomic malware analysis

Analyze another

@a2a-js/sdk 1.0.1

UNKNOWN
Verdict: HOSTILE
SHA256: 63853924e6f55792fd18f3e1639883f2846309cc3edcf44ef3086f9e7fe34f9b · 92%
“Server & Client SDK for Agent2Agent protocol”
Mal-ecule
O(Xe)H₅(Cm₁₃CrDb₄Po₂U)Md₂(Pa₄)
Size 636.0 KB download
First seen 2 days ago
Analyzed 1 day ago
Package pkg:npm/%40a2a-js/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 4 samples

Objectives

Micro-behaviors

notable severity, 82% confident.
communications/http/client JavaScript reads HTTP response text
notable severity, 85% confident.
communications/http/download npm script fetches over HTTP
notable severity, 86% confident.
communications/http/server Configures Express JSON body parser
notable severity, 80% confident.
communications/http/url Builds URL query parameters
notable severity, 88% confident.
communications/ipc AI agent skill entry declaration
notable severity, 88% confident.
crypto/hash Node.js createHash('sha256') call
notable severity, 86% confident.
data/encode Buffer output encoded as base64
notable severity, 80% confident.
process/hook Registers application middleware hook
notable severity, 85% confident.
process/interpreter Package script invokes a language interpreter
notable severity, 90% confident.
ui/window Reads input, form or option value

Metadata

notable severity, 90% confident.
package/manifest Repository identifies major Git host
notable severity, 90% confident.
package/quality Package declares TypeScript tooling

command-and-control

hostile severity, 95% confident.
dropper Script 'generate' downloads and executes code (dropper pattern)

20 of 31 traits shown

Identity

SHA-256 63853924e6f55792fd18f3e1639883f2846309cc3edcf44ef3086f9e7fe34f9b
Canonical SHA-256 01b73dfe942832d7db285ff9d6ed3bd7477a8be911470eb116dfa92521f2a43e
Filename sdk-1.0.1.tgz
Package @a2a-js/sdk
Version 1.0.1
PURL pkg:npm/%40a2a-js/[email protected]

Origin

Source upload
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/@a2a-js/sdk/-/sdk-1.0.1.tgz

Timeline

First seen 1 Aug 2026 22:10 UTC
First analyzed 1 Aug 2026 22:12 UTC
Last analyzed 3 Aug 2026 16:37 UTC
Last updated 3 Aug 2026 16:35 UTC

Labeling

Label unknown
Label source upload
Traits version 935ec