sensivity@2.5.39
Malicious code in sensivity (npm)
T1027 · Obfuscated Files or InformationT1140 · Deobfuscate/Decode Files or InformationT1059 · Command and Scripting InterpreterT1564 · Hide Artifacts
Analysis
sensivity@2.5.39 follows the same delivery chain as sibling versions: launcher.js loads a heavily obfuscated server.obf.js (8K+ obfuscated identifiers) via eval(fs.readFileSync(...)) and self-spawns a detached process (process.execPath, detached:true) for stealth persistence. The self-spawn-daemon plus eval-decoded-obfuscated-JS pattern is a known malware delivery chain.
- analyzed by
- Leitwacht
- first seen
- Jun 1, 2026, 09:02 PM
- analyzed
- Jun 1, 2026, 09:08 PM
Related advisories
- sensivity@2.5.38 same package
- sensivity@2.5.25 same package
- sensivity@2.5.24 same package
- sensivity@2.5.23 same package
- chai-chain-test@1.3.5
- electron-device-id@1.0.3
- @gbrlxvi/ts-form-utils@2.1.1
- sensivity@2.5.3 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.