Local reference
Suspicious dependency
Inferred
Mal-ecule
H(Cm)Md(Pa₃)
Referenced by 10 samples
- benign decocms-4.160.2.tgz fetched
- benign @yoamigo-sdk-2.2.4.tgz fetched
- benign better-auth-1.4.21.tgz fetched
- benign decocms-4.126.0.tgz fetched
- hostile github.com-coleam00-Archon-v0.7.1-0.20260802073809-f7513995d650.zip fetched
- benign github.com-decocms-studio-v3.18.13+incompatible.zip fetched
- benign github.com-trailbaseio-trailbase-v0.24.137.zip fetched
- benign @fragno-dev-github-app-fragment-0.0.3.tgz fetched
- benign decocms-4.177.2.tgz fetched
- hostile moeru-ai-airi-v0.10.2-AIRI-0.10.2-windows-x64-setup.exe fetched
Objectives
component severity, 80% confident.
supply-chain/install-hook/package
Repository uses GitHub shorthand format
Micro-behaviors
notable severity, 86% confident.
communications/http/url
Reads current path from browser location
baseline severity, 80% confident.
data/source/syntax
Reads an array element into a variable
component severity, 86% confident.
data/control-flow
Calls a parenthesized function expression
Metadata
notable severity, 90% confident.
package/manifest
Package declares TypeScript types entry
baseline severity, 80% confident.
file/profile
Contains common English function words
baseline severity, 99% confident.
lang
TypeScript declaration file
baseline severity, 100% confident.
package
package.json defines a package version
baseline severity, 90% confident.
package/dependencies
npm manifest omits devDependencies field
baseline severity, 100% confident.
package/quality
package.json defines a package name
component severity, 90% confident.
file
File has 30 or more lines
component severity, 100% confident.
file/extension
File uses a source declaration extension
component severity, 95% confident.
package/files
Filename is package.json
component severity, 85% confident.
package/testing/presence
File is a test or type-declaration source file
Identity
| SHA-256 | 8dfcb41a0b0d5d6907b2e62cddd5d1458ea0fa0540906acc300d89316222d4bd |
|---|---|
| Canonical SHA-256 | 450cfcba1cf4fc33185ccd721e7969889dbf7352ccbcb78ae21c4d818a23443f |
| Filename | nanostores-1.4.2.tgz |
| Package | nanostores |
| Version | 1.4.2 |
| PURL | pkg:npm/[email protected] |
Origin
| Source | upload |
|---|---|
| Ecosystem | javascript |
| Domain | npmjs.org |
| URL | https://registry.npmjs.org/nanostores/-/nanostores-1.4.2.tgz |
Timeline
| First seen | 1 Aug 2026 12:29 UTC |
|---|---|
| First analyzed | 1 Aug 2026 12:31 UTC |
| Last analyzed | 15 Aug 2026 14:56 UTC |
| Last updated | 15 Aug 2026 14:56 UTC |
Labeling
| Label | unknown |
|---|---|
| Label source | upload |
| Traits version | 02f7e |
Not seeing what you expected? Let us know