Critical Malware Feed Entry Detected 2026-08-08
Malware feed entry — detected by codelake scanners. This package was flagged malicious by our own detection pipeline. See the rules that fired and the package identifiers below. Full analysis, timeline and IOCs live on hand-curated advisories at /advisories; this page is the machine-generated receipt for the live feed.
Detection details
[email protected] published to vscode, flagged by codelake scanners on 2026-08-08 05:59 UTC.
Detector rules that fired on this package:
- Package combines 4 high-risk capabilities (network, filesystem, process, obfuscation) across multiple findings — combined profile indicates likely malware
behavior.escalate.capability-combination - Source writes to an AI-agent config/instruction file (CLAUDE.md / .claude / .cursor / MCP config / copilot-instructions / agent rules) — agent-control-surface tampering
behavior.static.agent-config-tamper - Source spawns a child process with a non-literal command
behavior.static.child-spawn-dynamic - Source writes a file and chmod's it executable — local-stager pattern
behavior.static.fs-write-and-chmod - Source contains a hard-coded ephemeral URL (raw IP / .top / .xyz / pastebin / discord webhook)
behavior.static.hidden-fetch - Source spawns a package-bundled native executable (local .exe/.dll/binary via __dirname/__filename) — native launcher; verify it is not a dropper
behavior.static.local-binary-spawn - Source contains a long base64 string literal — possible embedded payload
behavior.static.long-base64 - Source spawns a package-bundled native executable detached/hidden (windowsHide/detached) — native-binary dropper
behavior.static.native-binary-dropper - Source references a sensitive filesystem path (~/.ssh, /mnt/user-data, .aws/credentials, ...) — secret/workspace harvest
behavior.static.sensitive-path - Source spawns a LOLBin download/stager tool (curl/wget/certutil/bitsadmin/Invoke-WebRequest/iwr/nc/ncat) from a child process — stager pattern
behavior.static.shell-download-exec - Source opens a raw TCP socket from a user-controlled host
behavior.static.tcp-dial - Assembled string (template, 3 fragments) reconstructs to "(^|/).aws/credentials$" — sensitive-path; fed to a dynamic-execution sink
mosaic.assembled-sensitive-path - Assembled string (template, 3 fragments) reconstructs to "(^|/).git-credentials$" — sensitive-path; fed to a dynamic-execution sink
mosaic.assembled-sensitive-path - Assembled string (template, 3 fragments) reconstructs to "(^|/).npmrc$" — sensitive-path; fed to a dynamic-execution sink
mosaic.assembled-sensitive-path
This is an auto-generated entry in the codelake malware feed. Hand-curated deep case studies live on /advisories.