@hybridaione/[email protected]

@hybridaione/[email protected] published to npm, flagged by codelake scanners on 2026-07-03 08:13 UTC.

Detector rules that fired on this package:

• Install lifecycle hook (postinstall) executes a bundled script that itself contains malicious-behavior findings: scripts/postinstall-container.mjs behavior.scripts.install-hook-runs-flagged-script
• Source writes to an AI-agent config/instruction file (CLAUDE.md / .claude / .cursor / MCP config / copilot-instructions / agent rules) — agent-control-surface tampering behavior.static.agent-config-tamper
• Source spawns a child process with a non-literal command behavior.static.child-spawn-dynamic
• Source contains crypto-miner indicators (stratum pool / known miner names) behavior.static.crypto-miner
• Source decodes a payload (base64/hex/unescape) and dynamically exec's it (eval/Function/vm) in the same file — packed-payload dropper behavior.static.decode-exec
• Source executes a string as code (new Function / vm.run* / setTimeout("...")) — dynamic-eval pattern behavior.static.dynamic-exec
• Source loads a module from a non-literal name — opaque dependency behavior.static.dynamic-require
• Source issues a PUT/POST request reading local files, with a sensitive source or suspicious destination — outbound file-upload exfil behavior.static.exfil-outbound-upload
• Source writes a file and chmod's it executable — local-stager pattern behavior.static.fs-write-and-chmod
• Source contains a hard-coded ephemeral URL (raw IP / .top / .xyz / pastebin / discord webhook) behavior.static.hidden-fetch
• Source collects host/identity fingerprint (hostname/userInfo/networkInterfaces) and makes an outbound call — recon beacon behavior.static.recon-beacon
• Source opens a raw socket and spawns a child process in the same module — reverse-shell pattern behavior.static.reverse-shell
• Source reads a credential-shaped env var and exfiltrates it (encoding / file-harvest / C2 context) alongside an outbound call behavior.static.secret-exfil
• Source references a sensitive filesystem path (~/.ssh, /mnt/user-data, .aws/credentials, ...) — secret/workspace harvest behavior.static.sensitive-path
• Source references a C2 / exfil host (Telegram bot API, ngrok, webhook.site, requestbin, oast/interactsh, transfer.sh) — near-exclusive to malware behavior.static.suspicious-host
• Source opens a raw TCP socket from a user-controlled host behavior.static.tcp-dial
• Source disables TLS certificate validation (NODE_TLS_REJECT_UNAUTHORIZED=0 / rejectUnauthorized:false) — MITM enabler behavior.static.tls-disable
• Assembled string (template, 15 fragments) reconstructs to "cats+[^\n]*(.env|credentials|.netrc|.pgpass|.npmrc|.pypirc)" — sensitive-path mosaic.assembled-sensitive-path

This is an auto-generated entry in the codelake malware feed. Hand-curated deep case studies live on /advisories.