[email protected]

[email protected] published to npm, flagged by codelake scanners on 2026-09-29 08:12 UTC.

Detector rules that fired on this package:

• Source assembles a string from fragments and reaches a dynamic exec / process spawn — split-string evasion of an exec/command behavior.static.assembled-exec
• Source loads a module from a non-literal name — opaque dependency behavior.static.dynamic-require
• Source contains a hard-coded ephemeral URL (public raw IP / .top / .xyz / pastebin / discord webhook) behavior.static.hidden-fetch
• Source assembles a string from short literal fragments ("ev"+"al") — no legit reason; classic keyword/command-hiding obfuscation behavior.static.obfuscation-string-concat
• Assembled string (concat, 2 fragments) reconstructs to "eval" — code-token mosaic.assembled-code-token
• Assembled string (concat, 2 fragments) reconstructs to "exec" — code-token; fed to a dynamic-execution sink mosaic.assembled-code-token
• Assembled string (concat, 3 fragments) reconstructs to "spawn" — code-token; fed to a dynamic-execution sink mosaic.assembled-code-token
• Assembled string (concat, 4 fragments) reconstructs to "execSync" — code-token; fed to a dynamic-execution sink mosaic.assembled-code-token
• Assembled string (concat, 6 fragments) reconstructs to "constructor" — code-token mosaic.assembled-code-token
• Assembled string (concat, 7 fragments) reconstructs to "child_process" — code-token; fed to a dynamic-execution sink mosaic.assembled-code-token
• Assembled string (concat, 12 fragments) reconstructs to "http://39.96.50.154:8088" — url mosaic.assembled-url

This is an auto-generated entry in the codelake detections feed. Hand-curated deep case studies live on /advisories.