Open-source atomic malware analysis

Analyze another

@xmtp-wasm-bindings-1.10.0.tgz

TAR.GZ
Verdict: BENIGN
Mal-ecule
O(S)H(Po)Md(Pa₇)
Size 4.0 MB download
First seen 32 days ago
Analyzed 32 days ago
Ecosystem javascript
Source npmjs.org

Objectives

notable severity, 70% confident.
supply-chain/metadata-anomaly/dependency npm package has prepublishOnly hook

Micro-behaviors

notable severity, 70% confident.
process/interpreter JavaScript new Function constructor
baseline severity, 70% confident.
data Writing data to buffer at calculated offset
baseline severity, 70% confident.
data/source/syntax Function constructor keyword
baseline severity, 80% confident.
fs/enumerate References common system/dev directory names
baseline severity, 80% confident.
os/random getentropy function

Metadata

notable severity, 90% confident.
package Package has Prettier configuration
notable severity, 90% confident.
package/fields Package has TypeScript types entry
notable severity, 90% confident.
package/testing/presence Package uses Playwright testing framework
baseline severity, 80% confident.
file/text Sequential source identifier names
baseline severity, 95% confident.
import imports tsx from ^4.20.6
baseline severity, 95% confident.
import/npm::ianvs imports @ianvs/prettier-plugin-sort-imports from ^4.7.0
baseline severity, 95% confident.
import/npm::sqlite/org imports @sqlite.org/sqlite-wasm from ^3.47.0-build1
baseline severity, 95% confident.
import/npm::vitest imports @vitest/browser-playwright from ^4.0.8
baseline severity, 95% confident.
import/npm::xmtp imports @xmtp/content-type-remote-attachment from ^2.0.3
baseline severity, 100% confident.
lang new Promise() usage marker
baseline severity, 100% confident.
lang/encoded JavaScript file basename
baseline severity, 95% confident.
library Large bundled JavaScript graph
baseline severity, 90% confident.
package/testing/harness WebKit description() test helper

fs

notable severity, 80% confident.
file Script 'clean' performs file deletion

20 of 62 traits shown

Identity

SHA-256 70522eb0d736b3c5b4e313d2635874261e1209101370d95a3fc51bd6398695a1
Canonical SHA-256 5b21642538776a52ebf9f0eb218c5b9feae449f3d4c147ee8d11c74f706d665b
Filename @xmtp-wasm-bindings-1.10.0.tgz
Package @xmtp
Version 1.10.0

Origin

Source harvest
Feed npmjs.org
Ecosystem javascript
Domain npmjs.org

Timeline

First seen 16 May 2026 04:34 UTC
First analyzed 16 May 2026 04:44 UTC
Last analyzed 16 May 2026 04:44 UTC
Last updated 16 May 2026 04:44 UTC

Labeling

Label unknown
Label source harvest
Traits version 08128