sensivity@2.5.3
Malicious code in sensivity (npm)
T1140 · Deobfuscate/Decode Files or InformationT1027 · Obfuscated Files or Information
Analysis
sensivity@2.5.3 is a QR-phishing scam tool with persistence. launcher.js loads an obfuscated payload (server.obf.js) via eval(fs.readFileSync('server.obf.js','utf8')), masquerades its process as 'Runtime Broker', installs registry persistence at HKCU\Run as 'OneDriveUpdate', and deploys OneDrive.Standalone.Updater.vbs to silently launch the payload. It monitors Chrome for YouTube tabs every 3s and triggers a QR-code phishing flow to hxxp://192[.]168[.]1[.]16:3000, and ships a 6.8MB sens.node binary.
- analyzed by
- Leitwacht
- first seen
- Jun 1, 2026, 02:15 PM
- analyzed
- Jun 1, 2026, 02:31 PM
Related advisories
- sensivity@2.5.39 same package
- sensivity@2.5.38 same package
- sensivity@2.5.25 same package
- sensivity@2.5.24 same package
- sensivity@2.5.2 same package
- sensivity@2.5.0 same package
- argoncrypt@1.2.3
- chai-as-patched@7.0.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.