[email protected]

[email protected] published to npm, flagged by codelake scanners on 2026-08-20 09:41 UTC.

Detector rules that fired on this package:

• Package combines 4 high-risk capabilities (network, filesystem, process, obfuscation) across multiple findings — combined profile indicates likely malware behavior.escalate.capability-combination
• Install lifecycle hook (postinstall) executes a bundled script that itself contains malicious-behavior findings: scripts/post-install.js behavior.scripts.install-hook-runs-flagged-script
• Install lifecycle hook (preuninstall) executes a bundled script that itself contains malicious-behavior findings: scripts/pre-uninstall.js behavior.scripts.install-hook-runs-flagged-script
• Source spawns a child process with a non-literal command behavior.static.child-spawn-dynamic
• Source loads a module from a non-literal name — opaque dependency behavior.static.dynamic-require
• Source contains a hard-coded ephemeral URL (raw IP / .top / .xyz / pastebin / discord webhook) behavior.static.hidden-fetch
• File has high Shannon entropy — likely obfuscated / packed / encrypted payload behavior.static.high-entropy
• Source spawns a package-bundled native executable (local .exe/.dll/binary via __dirname/__filename) — native launcher; verify it is not a dropper behavior.static.local-binary-spawn
• Assembled string (template, 3 fragments) reconstructs to "powershell -NoProfile -Command \"Get-Process node -ErrorAction SilentlyContinue | Where-Object {$_.Path -like '*claw-suba…" — command; fed to a dynamic-execution sink mosaic.assembled-command

OSV reference: MAL-2026-3757

This is an auto-generated entry in the codelake malware feed. Hand-curated deep case studies live on /advisories.