Critical Malware Feed Entry Detected 2026-07-24
Malware feed entry — detected by codelake scanners. This package was flagged malicious by our own detection pipeline. See the rules that fired and the package identifiers below. Full analysis, timeline and IOCs live on hand-curated advisories at /advisories; this page is the machine-generated receipt for the live feed.
Detection details
@aicommander/[email protected] published to npm, flagged by codelake scanners on 2026-07-24 10:11 UTC.
Detector rules that fired on this package:
- Source issues a PUT/POST request reading local files, with a sensitive source or suspicious destination — outbound file-upload exfil
behavior.static.exfil-outbound-upload - Source references a sensitive filesystem path (~/.ssh, /mnt/user-data, .aws/credentials, ...) — secret/workspace harvest
behavior.static.sensitive-path - Assembled string (template, 5 fragments) reconstructs to "multiple /etc/passwd entries for \"aicommander-exec\" — refusing to guess which is the sandbox user" — sensitive-path; fed to a dynamic-execution sink
mosaic.assembled-sensitive-path - Assembled string (template, 5 fragments) reconstructs to "secure exec user \"aicommander-exec\" not found in /etc/passwd — reinstall the agent to create it" — sensitive-path; fed to a dynamic-execution sink
mosaic.assembled-sensitive-path
OSV reference: MAL-2026-10708
This is an auto-generated entry in the codelake malware feed. Hand-curated deep case studies live on /advisories.