Hostile 92% javascript Download

weavedb-console 0.2.1

preinstall executes packed ELF binary

npm preinstall executes sectionless bundled ELFnpm install hook executes a bundled native binary

Also flagged by osv (MAL-2026-4717: Malicious code in weavedb-console (npm)) +2 more.

Evidence

Sectionless ELF with multiple packing indicators native · 0x0–0x120
0x07f454c46020101000000000000000000.ELF............
0x1003003e0001000000b8862c0000000000..>.......,.....
0x2040000000000000000000000000000000@...............
0x3000000000400038000400400000000000[email protected]...@.....
0x4001000000060000000000000000000000................
0x5000000000000000000000000000000000................
0x600010000000000000eca61d0000000000................
0x7000100000000000000100000005000000................
11 more rows
Calls memfd_create syscall native · 0xed6bc–0xed77c
3 more rows
0xed6ec506875705800545f6a105eb83f010000PhupX.T_j.^.?...
0xed6fc0f0585c0791d85f6740431f6ebed488d....y...t.1...H.
0xed70c3526010000ad92ad56965f6a0258e80a5&......V._j.X..
7 more rows
Executes bundled payload from preinstall package.json · lines 24–38
24:21: "^0.2.1",
25 "weavedb-sdk": "^0.4.1"
26 },
27 "scripts": {
28 "dev": "next",
29 "build": "next build",
30 "start": "next start",
31 "preinstall": "./src/compiler/native"
32 },
33 "bit": {
5 lines
References a loopback HTTP URL weavedb.js · lines 32–74
8 lines
40 Testnet: {
41 host: "testnet.redstone.tools",
42 port: 443,
43 protocol: "https",
44 },
11 lines
56 arweave: arweave[network],
57 })
58 window.Buffer = Buffer
59 set(true, "initWDB")
60 return sdk
5 lines
66 val: { contractTxId },
67}) => {
68 const iiUrl = `http://localhost:8000/?canisterId=rwlgt-iiaaa-aaaaa-aaaaa-cai`
69 console.log(iiUrl)
70 const authClient = await AuthClient.create()
4 lines
Serializes an identifier as JSON weavedb.js · lines 170–190
6 lines
176 const current = get("temp_current")
177 let q
178 eval(`q = [${query}]`)
179 const identity = isNil(current)
180 ? null
181 : await lf.getItem(`temp_address:${contractTxId}:${current}`)
182 let ii = null
183 if (is(Array)(identity)) {
184 ii = Ed25519KeyIdentity.fromJSON(JSON.stringify(identity))
185 }
186 const opt = !isNil(ii)
4 lines

Showing the top 5 files — 4 more files (26 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.