AI
Legitimate Rook project source code
suspicious severity cross-file finding.
Go PAN-OS OpenVPN client key
suspicious severity cross-file finding.
Shell eval with base64 decode
suspicious severity cross-file finding.
udev rule command persistence
suspicious severity cross-file finding.
Mass file deletion pattern
notable severity cross-file finding.
Command with complex redirection and piping
notable severity cross-file finding.
Base64 decoding behavior
notable severity cross-file finding.
Dynamic code evaluation
notable severity cross-file finding.
Mass deletion action primitive
| 0 | PK�������������������J���github.com/rook/[email protected]5d81/.commcurl download to file |
Objectives
suspicious severity, 85% confident.
anti-static/obfuscation/payload
Shell eval with base64 decode
suspicious severity, 95% confident.
credential-access/cloud/token
Kubernetes credential extraction
suspicious severity, 94% confident.
impact/dos
NetScaler dd zero source
suspicious severity, 70% confident.
persistence/login/scheduled-task
Task restart count setting
suspicious severity, 80% confident.
privilege-escalation/elevation-control
sudo wget writes to privileged path
suspicious severity, 94% confident.
supply-chain/install-hook/package
Python pip list metadata
notable severity, 90% confident.
command-and-control/dropper/execution
Remote download piped into a shell
Micro-behaviors
notable severity, 90% confident.
communications/http/lib
Creates a new HTTP request
notable severity, 90% confident.
communications/http/request
Performs HTTP request (urllib, requests, httpx)
notable severity, 90% confident.
communications/ip
Repeated private 192.168 HTTP URL
notable severity, 90% confident.
crypto/hash
Python hmac.new operation
notable severity, 90% confident.
data/encode
Imports Python base64 module
Metadata
20 of 76 traits shown
Identity
| SHA-256 | cf9963b70c492bfb350c2a7f37b5c4c04cb9b19113e2702ce0dd32269bf8e983 |
|---|---|
| Canonical SHA-256 | 000e630dc3f047bd7d8ace3155c362686deef1dac22bb4dc10d30bf80c9b1759 |
| Filename | github.com-rook-rook-v0.0.0-20260527174449-7a84015d5d81.zip |
| Package | github.com/rook/rook |
| Version | v0.0.0-20260527174449-7a84015d5d81 |
Origin
| Source | forager |
|---|---|
| Feed | pkg.go.dev |
| Ecosystem | go |
| Domain | golang.org |
| URL | https://proxy.golang.org/github.com/rook/rook/@v/v0.0.0-20260527174449-7a84015d5d81.zip |
Timeline
| First seen | 15 Jun 2026 12:42 UTC |
|---|---|
| First analyzed | 16 Jun 2026 23:53 UTC |
| Last analyzed | 16 Jun 2026 23:53 UTC |
| Last updated | 16 Jun 2026 23:53 UTC |
Labeling
| Label | unknown |
|---|---|
| Label source | forager |
| Traits version | 27202 |
Not seeing what you expected? Let us know