Open-source atomic malware analysis

Analyze another

run-node 1.0.0

NPM
Verdict: BENIGN
SHA256: f928e633318f1911047d64e8c921e377f6bf9b5731bd7f602db65ab480ab4b99
“Run the Node.js binary no matter what”
Mal-ecule
H₂(FPo)Md(Pa)
Size 2.5 KB download
First seen 3 days ago
Analyzed 1 day ago
Package pkg:npm/[email protected]
Ecosystem javascript
Source registry.npmjs.org

Referenced by 10 samples

Objectives

component severity, 90% confident.
command-and-control/backdoor/tasking URL uses /run path
component severity, 85% confident.
discovery/network/scan References hidden scripts
component severity, 90% confident.
supply-chain/impersonation/package Republished package claims an upstream author

Micro-behaviors

notable severity, 86% confident.
fs/file/write Shell echo redirects output to a file
notable severity, 85% confident.
process/interpreter Package script invokes a language interpreter
baseline severity, 80% confident.
os/console Combined stdout+stderr redirect to /dev/null
component severity, 100% confident.
process/daemonize Redirects output to /dev/null

Metadata

notable severity, 90% confident.
package/manifest Repository uses owner/project coordinate
baseline severity, 80% confident.
file/profile Contains common English function words
baseline severity, 100% confident.
lang Bash shell shebang line
baseline severity, 100% confident.
package package.json defines a package version
baseline severity, 90% confident.
package/dependencies npm manifest omits devDependencies field
baseline severity, 75% confident.
package/keywords Package declares keywords
baseline severity, 65% confident.
package/manifest/author npm package author uses Gmail
baseline severity, 100% confident.
package/quality package.json defines a package name
component severity, 90% confident.
file File has 30 or more lines
component severity, 90% confident.
file/catalog References a GitHub or Google domain
component severity, 100% confident.
file/extension Text, document, or config extension

20 of 23 traits shown

Identity

SHA-256 f928e633318f1911047d64e8c921e377f6bf9b5731bd7f602db65ab480ab4b99
Filename [email protected]
Package run-node
Version 1.0.0
PURL pkg:npm/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem javascript
Domain npmjs.org
URL https://registry.npmjs.org/run-node/-/run-node-1.0.0.tgz

Timeline

First seen 11 Aug 2026 17:02 UTC
First analyzed 11 Aug 2026 17:02 UTC
Last analyzed 13 Aug 2026 08:04 UTC
Last updated 13 Aug 2026 08:04 UTC

Labeling

Label unknown
Traits version 73866