Open-source atomic malware analysis

Analyze another

@vue/compiler-sfc 2.7.16

UNKNOWN
Verdict: BENIGN
SHA256: e646a601c3a2cc0e16387344a7f390a27b385d54855e37ac2a9d2f9aaf743cfa
“compiler-sfc for Vue 2”
Mal-ecule
O(S)H₆(Cm₄Db₁₀FOs₂Po₂U)Md₃(Pa₃Pt)
Size 162.9 KB download
First seen 17 days ago
Analyzed 10 days ago
Package pkg:npm/@vue/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 9 samples

Objectives

notable severity, 90% confident.
supply-chain/hidden-payload Node module compile call

Micro-behaviors

notable severity, 96% confident.
communications/http Sets JWT subject identity claim
notable severity, 90% confident.
communications/http/url References a public code-forge URL
notable severity, 88% confident.
data Converts Node.js Buffer output to text
notable severity, 90% confident.
data/control-flow JavaScript iterates enumerable object keys
notable severity, 90% confident.
data/decode Calls JavaScript unescape
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 85% confident.
data/serialize Serializes an identifier as JSON
notable severity, 90% confident.
data/string Chains multiple JavaScript string replacements
notable severity, 90% confident.
fs/file Calls readFileSync
notable severity, 94% confident.
os/api-resolution Constructs Node module via module.constructor
notable severity, 90% confident.
os/module CommonJS require inside try fallback
notable severity, 95% confident.
process/interpreter Node Module._compile runtime-code method
notable severity, 82% confident.
ui/window/manage Creates DOM element

Metadata

notable severity, 90% confident.
file Several Base64-looking strings in source
notable severity, 99% confident.
file/profile Escaped Unicode script codepoint in source
notable severity, 96% confident.
lang/encoded Over 1000 Unicode escapes in JavaScript
notable severity, 80% confident.
package/dependencies Package has optional dependencies
notable severity, 90% confident.
package/manifest Package declares TypeScript types entry

20 of 39 traits shown

Identity

SHA-256 e646a601c3a2cc0e16387344a7f390a27b385d54855e37ac2a9d2f9aaf743cfa
Canonical SHA-256 3a2221d761239b9da0c8d5235fca0bd9ec6abba589b21bfc907fcc9bf7bd58fb
Filename [email protected]
Package @vue/compiler-sfc
Version 2.7.16
PURL pkg:npm/@vue/[email protected]

Origin

Source x
Feed beekeeperstudio
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-2.7.16.tgz

Timeline

First seen 12 Aug 2026 01:19 UTC
First analyzed 12 Aug 2026 01:18 UTC
Last analyzed 19 Aug 2026 03:45 UTC
Last updated 19 Aug 2026 03:49 UTC

Labeling

Label unknown
Traits version 8ac81