Open-source atomic malware analysis

Analyze another

@bobfrankston/mailx-store-web 0.1.69

UNKNOWN
Verdict: HOSTILE
Mal-ecule
K(Li₂)O(Eu)H₆(Cm₂₁Db₁₀Os₂Po₂TiU)Md₃(LiPa₄)
Size 246.8 KB download
First seen 1 day ago
Analyzed 1 day ago
Package pkg:npm/%40bobfrankston/[email protected]
Ecosystem javascript
Also detected by 1 source

Referenced by 2 samples

Well-known

notable severity, 99% confident.
lib Recognized mailx-types library package context

Objectives

hostile severity, 99% confident.
exfiltration/http IMAP config JSON sent to remote logger

Micro-behaviors

notable severity, 90% confident.
communications/email MIME base64 attachment encoding
notable severity, 97% confident.
communications/email/access Logs serialized IMAP account config
notable severity, 94% confident.
communications/email/send Configures SMTP XOAUTH2 with a token
notable severity, 94% confident.
communications/http/client Opens a synchronous XMLHttpRequest GET request
notable severity, 90% confident.
communications/http/header References HTTP Content-Type application/json
notable severity, 90% confident.
communications/http/services Google People contacts API
notable severity, 94% confident.
communications/websocket WebSocket sends a typed binary buffer
notable severity, 90% confident.
data/db Calls localStorage or sessionStorage getItem
notable severity, 94% confident.
data/decode Masks character code to one byte
notable severity, 90% confident.
data/encode Builds characters with String.fromCharCode
notable severity, 90% confident.
os/module Dynamically imports a non-relative module path

Metadata

notable severity, 90% confident.
file Several Base64-looking strings in source
notable severity, 95% confident.
library Preserves original JavaScript console methods

20 of 38 traits shown

Identity

SHA-256 fa55e1bbebc3babe3ca90132d0f3a4c01a56e5782775ee052b4e7283738fe427
Canonical SHA-256 016102c14d0dd650697a500523f05d6c9cae519d01989e7533259246d62fb955
Filename mailx-store-web-0.1.69.tgz
Package @bobfrankston/mailx-store-web
Version 0.1.69
PURL pkg:npm/%40bobfrankston/[email protected]

Timeline

First seen 3 Aug 2026 23:21 UTC
First analyzed 3 Aug 2026 23:23 UTC
Last analyzed 4 Aug 2026 09:25 UTC
Last updated 4 Aug 2026 09:23 UTC

Labeling

Label bad
Label source cyclotron:new
Traits version 6052a