Critical Malware Feed Entry Detected 2026-07-26
Malware feed entry — detected by codelake scanners. This package was flagged malicious by our own detection pipeline. See the rules that fired and the package identifiers below. Full analysis, timeline and IOCs live on hand-curated advisories at /advisories; this page is the machine-generated receipt for the live feed.
Detection details
[email protected] published to npm, flagged by codelake scanners on 2026-07-26 05:36 UTC.
Detector rules that fired on this package:
- Package combines 4 high-risk capabilities (network, filesystem, process, obfuscation) across multiple findings — combined profile indicates likely malware
behavior.escalate.capability-combination - Package ships a .env file (may contain secrets): packages/client/fixtures/mongo/prisma/.env — secret/credential leak via the registry
behavior.shipped.credential-file - Package ships a .env file (may contain secrets): packages/client/src/__tests__/integration/happy/browser/prisma/.env — secret/credential leak via the registry
behavior.shipped.credential-file - Package ships a .env file (may contain secrets): packages/config/src/__tests__/fixtures/loadConfigFromFile/env-load-cjs/.env — secret/credential leak via the registry
behavior.shipped.credential-file - Package ships a .env file (may contain secrets): packages/config/src/__tests__/fixtures/loadConfigFromFile/env-load-esm/.env — secret/credential leak via the registry
behavior.shipped.credential-file - Package ships a .env file (may contain secrets): packages/internals/src/__tests__/__fixtures__/dotenv/.env — secret/credential leak via the registry
behavior.shipped.credential-file - Package ships a .env file (may contain secrets): packages/migrate/src/__tests__/fixtures/schema-only-cockroachdb/prisma/.env — secret/credential leak via the registry
behavior.shipped.credential-file - Package ships a .env file (may contain secrets): packages/migrate/src/__tests__/fixtures/schema-only-postgresql/prisma/.env — secret/credential leak via the registry
behavior.shipped.credential-file - Source spawns a child process with a non-literal command
behavior.static.child-spawn-dynamic - Source loads a module from a non-literal name — opaque dependency
behavior.static.dynamic-require - Source contains a hard-coded ephemeral URL (raw IP / .top / .xyz / pastebin / discord webhook)
behavior.static.hidden-fetch - Source disables TLS certificate validation (NODE_TLS_REJECT_UNAUTHORIZED=0 / rejectUnauthorized:false) — MITM enabler
behavior.static.tls-disable
OSV reference: MAL-2026-3770
This is an auto-generated entry in the codelake malware feed. Hand-curated deep case studies live on /advisories.