sensivity@2.5.5
Malicious code in sensivity (npm)
Analysis
sensivity@2.5.5 is a RAT/backdoor masquerading as a "Mobile Control Panel". launcher.js loads a 76KB obfuscated payload (server.obf.js, ~4900 _0x identifiers) via eval(fs.readFileSync('server.obf.js','utf8')). It masquerades its process as 'Runtime Broker', installs registry persistence at HKCU\...\Run named 'OneDriveUpdate', drops a VBS file (OneDrive.Standalone.Updater.vbs) that silently launches node.exe launcher.js, triggers a QR-code pairing flow on YouTube Chrome-window detection, and ships a 6.8MB sens.node native addon — classic RAT behaviour: masquerading, persistence and heavy obfuscation.
- analyzed by
- Leitwacht
- first seen
- Jun 1, 2026, 02:22 PM
- analyzed
- Jun 1, 2026, 02:32 PM
Related advisories
- sensivity@2.5.39 same package
- sensivity@2.5.38 same package
- sensivity@2.5.25 same package
- sensivity@2.5.24 same package
- sensivity@2.5.3 same package
- sensivity@2.5.2 same package
- sensivity@2.5.0 same package
- argoncrypt@1.2.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.