Open-source atomic malware analysis

Analyze another

@rollup/plugin-replace 2.3.4

UNKNOWN
Verdict: BENIGN
SHA256: d29420c0430a4d598ed0a88f1a8bb723e9f0f3ba844e4c879485d38b450a37ae
“Replace strings in files while bundling”
Mal-ecule
Md(Pa₇)
Size 5.4 KB download
First seen 27 days ago
Analyzed 6 days ago
Package pkg:npm/@rollup/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 10 samples

Objectives

component severity, 80% confident.
supply-chain/install-hook/package Repository uses GitHub shorthand format
component severity, 95% confident.
supply-chain/install-hook/scripts prepare runs package-manager build

Micro-behaviors

component severity, 90% confident.
data/serialize JSON-like object result field

Metadata

notable severity, 90% confident.
package README recommends scoped package installation
notable severity, 90% confident.
package/manifest Repository uses owner/project coordinate
notable severity, 90% confident.
package/quality Package declares TypeScript tooling
baseline severity, 80% confident.
file/profile Contains common English function words
baseline severity, 99% confident.
lang TypeScript declaration file
component severity, 90% confident.
build JavaScript file under a distribution directory
component severity, 90% confident.
file File has 30 or more lines
component severity, 100% confident.
file/extension File uses a source declaration extension
component severity, 70% confident.
package/dependencies npm manifest has many devDependencies
component severity, 85% confident.
package/testing/presence File is a test or type-declaration source file

supply-chain

notable severity, 80% confident.
install-hook Package has 'prepare' hook that runs during install

Identity

SHA-256 d29420c0430a4d598ed0a88f1a8bb723e9f0f3ba844e4c879485d38b450a37ae
Canonical SHA-256 207e02b882f1f4f14ca41ffab86dcd22a492071c2e8fbb2e216e389757afd1f1
Filename [email protected]
Package @rollup/plugin-replace
Version 2.3.4
PURL pkg:npm/@rollup/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/@rollup/plugin-replace/-/plugin-replace-2.3.4.tgz

Timeline

First seen 2 Aug 2026 03:58 UTC
First analyzed 2 Aug 2026 04:00 UTC
Last analyzed 23 Aug 2026 06:48 UTC
Last updated 23 Aug 2026 06:50 UTC

Labeling

Label unknown
Traits version 298c2