sensivity@2.5.38
Malicious code in sensivity (npm)
T1027 · Obfuscated Files or Information
Analysis
sensivity@2.5.38 follows the same delivery chain as sibling versions: launcher.js loads a heavily obfuscated server.obf.js (8K+ obfuscated identifiers) via eval(fs.readFileSync(...)) and self-spawns a detached process (process.execPath, detached:true) for stealth persistence. The self-spawn-daemon plus eval-decoded-obfuscated-JS pattern is a known malware delivery chain.
- analyzed by
- Leitwacht
- first seen
- Jun 1, 2026, 09:02 PM
- analyzed
- Jun 1, 2026, 09:08 PM
Related advisories
- sensivity@2.5.39 same package
- sensivity@2.5.25 same package
- sensivity@2.5.24 same package
- sensivity@2.5.23 same package
- chai-chain-test@1.3.5
- electron-device-id@1.0.3
- @keeneye/uikit@5.0.1
- @keeneye/toolkit@5.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.