Benign Download

50/50/505010200450206226e09179a636f2aed149c7f8707df74df7a2c21dcf1d783f

Composite catalog lists alternative rulesComposite catalog requires rule references
SHA-256505010200450206226e09179a636f2aed149c7f8707df74df7a2c21dcf1d783f
MaleculeH(F)Md

Evidence

chmod adds executable permissions lines 8–12
8:63… literal is keyed.
9# The signal is the data-flow shape fetch -> chmod +x -> run, which survives
10# obfuscation-seed rotation, account rotation, and filename changes.
11#
12# FP boundary: benign binary-wrapp …
Top-level traits or composite_rules key lines 15–26
15:12… leg (detached + stdio:'ignore' / windowsHide, or an execPath
16# self-respawn) is the discriminator — a wrapper has no reason to hide its tool.
17defaults:
18 crit: hostile
19 platforms: [unix, windows]
20 for: [javascript, typescript]
21 attack: T1105
22 mbc: B0024
23composite_rules:
24 - id: npm-postinstall-configurable-native-stager
25 desc: npm postinstall stages configurable native payload
26 conf: 0.98

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.