High Malware Feed Entry Detected 2026-07-05
Malware feed entry — detected by codelake scanners. This package was flagged malicious by our own detection pipeline. See the rules that fired and the package identifiers below. Full analysis, timeline and IOCs live on hand-curated advisories at /advisories; this page is the machine-generated receipt for the live feed.
Detection details
[email protected] published to npm, flagged by codelake scanners on 2026-07-05 17:56 UTC.
Detector rules that fired on this package:
- Dependency 'node-ews' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry
behavior.manifest.non-registry-dependency - Scan hit its resource budget before finishing — package too large/complex to fully analyze; flagged for manual review (resisting the scanner is itself a risk signal)
behavior.scan.incomplete - Package ships a private key / certificate file: _init/monotomic.key — secret/credential leak via the registry
behavior.shipped.credential-file - Source decodes a payload (base64/hex/unescape) and dynamically exec's it (eval/Function/vm) in the same file — packed-payload dropper
behavior.static.decode-exec - Source executes a string as code (new Function / vm.run* / setTimeout("...")) — dynamic-eval pattern
behavior.static.dynamic-exec - Source loads a module from a non-literal name — opaque dependency
behavior.static.dynamic-require - Source contains a hard-coded ephemeral URL (raw IP / .top / .xyz / pastebin / discord webhook)
behavior.static.hidden-fetch - Source contains a long base64 string literal — possible embedded payload
behavior.static.long-base64 - Source builds strings from char codes / hex escapes — obfuscation (often wraps a hidden payload)
behavior.static.obfuscation-charcode - Source references a sensitive filesystem path (~/.ssh, /mnt/user-data, .aws/credentials, ...) — secret/workspace harvest
behavior.static.sensitive-path - Assembled string (concat, 2 fragments) reconstructs to "exec" — code-token; fed to a dynamic-execution sink
mosaic.assembled-code-token - Assembled string (concat, 3 fragments) reconstructs to "module" — code-token; fed to a dynamic-execution sink
mosaic.assembled-code-token - Assembled string (concat, 4 fragments) reconstructs to "process" — code-token
mosaic.assembled-code-token - Assembled string (concat, 4 fragments) reconstructs to "process" — code-token; fed to a dynamic-execution sink
mosaic.assembled-code-token - Assembled string (concat, 4 fragments) reconstructs to "require" — code-token
mosaic.assembled-code-token - Assembled string (concat, 5 fragments) reconstructs to "setTimeout" — code-token; fed to a dynamic-execution sink
mosaic.assembled-code-token - Assembled string (concat, 6 fragments) reconstructs to "constructor" — code-token; fed to a dynamic-execution sink
mosaic.assembled-code-token - Assembled string (escape, 1 fragments) reconstructs to "module" — code-token
mosaic.assembled-code-token - Assembled string (concat, 4 fragments) reconstructs to "/.npmrc" — sensitive-path
mosaic.assembled-sensitive-path - Assembled string (concat, 8 fragments) reconstructs to ".aws/credentials" — sensitive-path
mosaic.assembled-sensitive-path - Assembled string (concat, 9 fragments) reconstructs to "/.aws/credentials" — sensitive-path
mosaic.assembled-sensitive-path - Assembled string (concat, 14 fragments) reconstructs to "https://api.telegram.org/bot" — url
mosaic.assembled-url
This is an auto-generated entry in the codelake malware feed. Hand-curated deep case studies live on /advisories.