Critical Malware Feed Entry Detected 2026-08-08
Malware feed entry — detected by codelake scanners. This package was flagged malicious by our own detection pipeline. See the rules that fired and the package identifiers below. Full analysis, timeline and IOCs live on hand-curated advisories at /advisories; this page is the machine-generated receipt for the live feed.
Detection details
[email protected] published to npm, flagged by codelake scanners on 2026-08-08 05:34 UTC.
Detector rules that fired on this package:
- Install lifecycle hook (postinstall) executes a bundled script that itself contains malicious-behavior findings: dist/index5_test.js
behavior.scripts.install-hook-runs-flagged-script - Source assembles a string from fragments and reaches a dynamic exec / process spawn — split-string evasion of an exec/command
behavior.static.assembled-exec - Source assembles a string from short literal fragments ("ev"+"al") — no legit reason; classic keyword/command-hiding obfuscation
behavior.static.obfuscation-string-concat - Source collects host/identity fingerprint (hostname/userInfo/networkInterfaces) and makes an outbound call — recon beacon
behavior.static.recon-beacon - Source opens a raw socket and spawns a child process in the same module — reverse-shell pattern
behavior.static.reverse-shell - Source opens a raw TCP socket from a user-controlled host
behavior.static.tcp-dial
OSV reference: MAL-2026-3182
This is an auto-generated entry in the codelake malware feed. Hand-curated deep case studies live on /advisories.