sensivity@2.5.0
Malicious code in sensivity (npm)
Analysis
sensivity@2.5.0 is a Windows RAT/game-cheat hybrid. launcher.js loads a 111KB obfuscated payload (server.obf.js, thousands of _0x identifiers) via eval(fs.readFileSync(...)), masquerades its process as 'Runtime Broker', installs registry persistence at HKCU\...\Run\OneDriveUpdate via a misspelled VBScript (OneDrive.Standalone.Updater.vbs), monitors Chrome for YouTube tabs, and displays a QR code pointing to hxxp://192[.]168[.]1[.]16:3000 when YouTube is detected. The persistence, process masquerading, process-scanning and eval'd obfuscated payload are characteristic of a RAT/session hijacker.
- analyzed by
- Leitwacht
- first seen
- Jun 1, 2026, 02:09 PM
- analyzed
- Jun 1, 2026, 02:26 PM
Related advisories
- sensivity@2.5.39 same package
- sensivity@2.5.38 same package
- sensivity@2.5.25 same package
- sensivity@2.5.24 same package
- argoncrypt@1.2.3
- chai-as-patched@7.0.6
- @redhat-cloud-services/hcc-kessel-mcp@0.3.1
- vitest-preview-pro@10.0.7
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.