Open-source atomic malware analysis

Analyze another

rimraf 4.4.1

UNKNOWN
Verdict: BENIGN
SHA256: df31361843e46bd856b7ee6a8b7e81219c6544cc02bcc89d13f8bcb8b1f51426
“A deep deletion module for node (like `rm -rf`)”
Mal-ecule
H₃(F₃OsPo₂)Md(Pa₆)
Size 40.7 KB download
First seen 17 days ago
Analyzed 14 days ago
Package pkg:npm/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 8 samples

Micro-behaviors

notable severity, 80% confident.
fs/directory Calls the rimraf recursive-deletion API
notable severity, 80% confident.
os/sysinfo/platform Reads the Node.js process.platform value
notable severity, 80% confident.
process/io References Node.js stdout stream
baseline severity, 70% confident.
fs/path Windows Temp directory path
baseline severity, 80% confident.
fs/temp Uses the Node.js system temporary directory
baseline severity, 80% confident.
process/info Reads Node.js arguments through process.argv

Metadata

baseline severity, 90% confident.
build Code has source map reference
baseline severity, 85% confident.
file High function density
baseline severity, 80% confident.
file/profile Contains common English function words
baseline severity, 99% confident.
lang TypeScript declaration file

supply-chain

notable severity, 80% confident.
install-hook Package has 'prepare' hook that runs during install

20 of 29 traits shown

Identity

SHA-256 df31361843e46bd856b7ee6a8b7e81219c6544cc02bcc89d13f8bcb8b1f51426
Canonical SHA-256 04bda915215d68896fab6cf5574fa5cdc231aec061e92ed57e4a00a3d42f9a23
Filename [email protected]
Package rimraf
Version 4.4.1
PURL pkg:npm/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/rimraf/-/rimraf-4.4.1.tgz

Timeline

First seen 11 Aug 2026 22:46 UTC
First analyzed 11 Aug 2026 22:47 UTC
Last analyzed 15 Aug 2026 04:26 UTC
Last updated 15 Aug 2026 04:26 UTC

Labeling

Label unknown
Traits version 73866