Hostile ^92% javascript Download

arnext-arkb 0.0.2

Preinstall executes packed ELF binary

npm preinstall executes sectionless bundled ELFnpm install hook executes a bundled native binary

SHA-256f57139fe9fb76ec3f428a73b7ac2b8b1e7ac353d004fc8a49c49883cbcbb65d5

URLhttps://registry.npmjs.org/arnext-arkb/-/arnext-arkb-0.0.2.tgz

MaleculeO₂(S₂As)H₆(Cm₂Cr₃Db₅F₂Os₃U)Md₄(Bi₃BkHePa₄)

Also flagged by osv (MAL-2026-4483: Malicious code in arnext-arkb (npm)) +3 more.

Evidence

Sectionless ELF with multiple packing indicators install-deps · 0x0–0x120

0x07f454c46020101000000000000000000.ELF............
0x1003003e0001000000b8862c0000000000..>.......,.....
0x2040000000000000000000000000000000@...............
0x3000000000400038000400400000000000[email protected]...@.....
0x4001000000060000000000000000000000................
0x5000000000000000000000000000000000................
0x600010000000000000eca61d0000000000................
0x7000100000000000000100000005000000................
⋯11 more rows

Calls memfd_create syscall install-deps · 0xed6bc–0xed77c

⋯3 more rows
0xed6ec506875705800545f6a105eb83f010000PhupX.T_j.^.?...
0xed6fc0f0585c0791d85f6740431f6ebed488d....y...t.1...H.
0xed70c3526010000ad92ad56965f6a0258e80a5&......V._j.X..
⋯7 more rows

x86-64 mmap syscall in sectionless code install-deps · 0xed7c8–0xed898

⋯3 more rows
0xed7f85c4d31c94d89e06a01415a6a055a29ff\M1.M..j.AZj.Z).
0xed8086a0958e819000000504889451841505fj.X.....PH.E.AP_
0xed8186a03580f05584883c010ffe0f30f1efaj.X..XH.........
0xed828c3500f0559483d00f0ffff7201f4c3c0.P..YH=....r....
⋯7 more rows

Executes bundled payload from preinstall package.json · lines 1–31

1{
"name": "arnext-arkb",
"version": "0.0.2",
"main": "./bin/app.js",
"license": "MIT",
"files": [
  "bin/**/*"
,"bin"],
"bin": {
  "arkb": "./bin/app.js"
},
"engines": {
  "node": ">=15.11.0",
  "npm": ">=7.6.0"
},
"scripts": {
  "preinstall": "./bin/install-deps"
},
"dependencies": {
  "@supercharge/promise-pool": "^1.7.0",
  "@textury/ardb": "^1.1.3",
  "arbundles": "^0.6.19",
  "arweave": "^1.15.5",
  "arweave-stream-tx": "^1.1.0",
  "axios": "^0.21.4",
  "blockweave": "^1.0.15",
  "clear": "^0.1.0",
⋯4 lines

JavaScript iterates enumerable object keys deploy.js · lines 19–22

20… __esModule) return mod;
  var result = {};
  if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
  __setModuleDefault(re …

Showing the top 5 files — 6 more files (26 regions) not shown.

No evidence locations were recorded for this file. Raw result