Open-source atomic malware analysis

Analyze another

csstype 3.0.9

NPM
Verdict: BENIGN
SHA256: c0584fd763322c6ea2dbed8e91728a4c4fd97e67a91b1b3b3b128066cd156dd8
“Strict TypeScript and Flow types for style based on MDN data”
Mal-ecule
H(Po)Md₂(Pa₃)
Size 169.9 KB download
First seen 24 days ago
Analyzed 16 days ago
Package pkg:npm/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 3 samples

Objectives

component severity, 92% confident.
anti-static/obfuscation Eval initial word: alpha
component severity, 92% confident.
impact/ransom/encrypt LLM targets index or vector data
component severity, 90% confident.
supply-chain/impersonation/package Republished package claims an upstream author

Micro-behaviors

notable severity, 85% confident.
process/interpreter Package script invokes a language interpreter
baseline severity, 70% confident.
os/sysinfo/platform WebKit/Blink via WebkitAppearance style
component severity, 95% confident.
communications/url Encoded URL references MDN documentation
component severity, 92% confident.
ui/window Browser selector targets editable page content

Metadata

notable severity, 97% confident.
file Many Base64-like comment spans in JavaScript
notable severity, 85% confident.
package Package declares a prepublish-only script
notable severity, 90% confident.
package/manifest Package declares TypeScript types entry
notable severity, 90% confident.
package/quality Package declares TypeScript tooling
baseline severity, 80% confident.
file/profile Contains common English function words
baseline severity, 99% confident.
lang TypeScript declaration file
baseline severity, 90% confident.
package/dependencies npm manifest omits dependencies field
baseline severity, 75% confident.
package/keywords Package declares keywords
baseline severity, 90% confident.
package/testing/presence Package uses Jest testing framework
component severity, 100% confident.
file/extension Markdown document file extension

supply-chain

notable severity, 80% confident.
install-hook Package has 'prepublish' hook that runs during install

20 of 27 traits shown

Identity

SHA-256 c0584fd763322c6ea2dbed8e91728a4c4fd97e67a91b1b3b3b128066cd156dd8
Filename [email protected]
Package csstype
Version 3.0.9
PURL pkg:npm/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/csstype/-/csstype-3.0.9.tgz

Timeline

First seen 4 Aug 2026 10:48 UTC
First analyzed 4 Aug 2026 10:50 UTC
Last analyzed 12 Aug 2026 06:45 UTC
Last updated 12 Aug 2026 06:45 UTC

Labeling

Label unknown
Traits version 73866