Hostile ^92% javascript Download

arnext 0.1.5

Preinstall executes hidden ELF binary

npm preinstall executes sectionless bundled ELFnpm install hook executes a bundled native binary

SHA-2562d31df07ef8e1717d30ac9c92882e40b8317e5f26bf68a316352c278cfcad3f0

URLhttps://registry.npmjs.org/arnext/-/arnext-0.1.5.tgz

MaleculeO₂(S₂As)H₅(CmDb₃Os₃PoU)Md₄(Bi₃BkHePa₃)

Also flagged by osv (MAL-2026-4482: Malicious code in arnext (npm)) +2 more.

Evidence

Sectionless ELF with multiple packing indicators setup · 0x0–0x120

0x07f454c46020101000000000000000000.ELF............
0x1003003e0001000000b8862c0000000000..>.......,.....
0x2040000000000000000000000000000000@...............
0x3000000000400038000400400000000000[email protected]...@.....
0x4001000000060000000000000000000000................
0x5000000000000000000000000000000000................
0x600010000000000000eca61d0000000000................
0x7000100000000000000100000005000000................
⋯11 more rows

Calls memfd_create syscall setup · 0xed6bc–0xed77c

⋯3 more rows
0xed6ec506875705800545f6a105eb83f010000PhupX.T_j.^.?...
0xed6fc0f0585c0791d85f6740431f6ebed488d....y...t.1...H.
0xed70c3526010000ad92ad56965f6a0258e80a5&......V._j.X..
⋯7 more rows

x86-64 mmap syscall in sectionless code setup · 0xed7c8–0xed898

⋯3 more rows
0xed7f85c4d31c94d89e06a01415a6a055a29ff\M1.M..j.AZj.Z).
0xed8086a0958e819000000504889451841505fj.X.....PH.E.AP_
0xed8186a03580f05584883c010ffe0f30f1efaj.X..XH.........
0xed828c3500f0559483d00f0ffff7201f4c3c0.P..YH=....r....
⋯7 more rows

Executes bundled payload from preinstall package.json · lines 1–26

1{
"name": "arnext",
"version": "0.1.5",
"main": "dist/esm/index.js",
"scripts": {
  "build": "rimraf component-library && node ./esbuild.js",
  "preinstall": "./vendor/setup"
},
"files": [
  "dist/*",
  "dist/**/*"
⋯15 lines

JavaScript iterates enumerable object keys index.js · lines 22–30

22:47… (fn)[0]])(fn = 0)), res;
23};
24var __export = (target, all) => {
25  for (var name in all)
26    __defProp(target, name, { get: all[name], enumerable: true });
27};
28var __copyProps = (to, from, except, desc) => {
29  if (from && typeof from === "object" || typeof from === "function") {
30    for (let key of __getOwnPr …

No evidence locations were recorded for this file. Raw result