Our AI threat analyst detects malicious packages and blogs about OSS compromises
7000 write-ups and countingRead one

Spectra Assure

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

npm

Search by package name, PURL or hash

Quarantine

Scanned:

openpaw-graveyard

latest

OpenPaw - Autonomous AI agent with onchain social identity on Solana via Tapestry, Helius RPC, local LLM

License: Permissive (MIT)

Published:

See on npm

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

1 quarantined components found

Malware

No evidence of malware inclusion

Overview issues6 vulnerabilities0 malware0 behaviors49 dependencies5 contributors1 versions1

FAQ for openpaw-graveyard

What is openpaw-graveyard?

OpenPaw - Autonomous AI agent with onchain social identity on Solana via Tapestry, Helius RPC, local LLM.

Is openpaw-graveyard malicious or is it safe to use?

The npm package openpaw-graveyard was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. Malware or tampering has been detected, making it unsafe to download and use. The package contains risks, and the analysis results should be reviewed before it is downloaded and used. Visit the Issues and Behaviors sections of the analysis for more details.

Is openpaw-graveyard popular?

The npm package openpaw-graveyard is not widely used. It has 420 recorded downloads. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

How do I secure openpaw-graveyard once it is in my app?

Since we can't know when or where malicious attacks will happen, we recommend tracking how openpaw-graveyard behaviors change over multiple software releases. By adopting differential analysis in your release process, you can detect unexpected changes to a openpaw-graveyard version, which can prevent advanced software supply chain attacks. Read how our technology can help prevent future attacks similar to SolarWinds and 3CX.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

Popularity

420

Recorded Downloads Since 2021

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. The ReversingLabs community package index may place software packages into quarantine during an ongoing security incident investigation. When a software project is placed into quarantine, it is typically unavailable for installation. Additionally, repository maintainers may also hide quarantined software projects from users that might stumble upon them using repository search functions. Quarantine is typically raised for software projects that were reported for unusual code changes or unexpected software behaviors.

Prevalence in npm community

No prevalence information at this time

Next steps

Inspect behaviors exhibited by the detected software components.

If the software behaviors differ from expected, investigate the build and release environment for software supply chain compromise.

Revise the use of components that raise these alarms. If you can't deprecate those components, make sure they are well-documented.

Avoid using this software package until it is vetted as safe.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. Node Package Manager (NPM) repository is often abused by threat actors to publish software packages that exhibit malicious behaviors. Malware authors use numerous tactics to lure developers into including malicious NPM packages in their software projects. Most malicious packages published on NPM target developers and their workstations. However, some are designed to activate only when deployed in the end-user environment. Both types of NodeJS malicious packages are detected by proprietary ReversingLabs threat hunting algorithms. This detection method is considered proactive, and it is based on Machine Learning (ML) algorithms that can detect novel malware. The detection is strongly influenced by behaviors that software components exhibit. Behaviors similar to previously discovered malware and software supply chain attacks may cause some otherwise benign software packages to be detected by this policy.

Prevalence in npm community

5 packages

found in

Top 100

2 packages

found in

Top 1k

39 packages

found in

Top 10k

21.37k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in npm community

2 packages

found in

Top 100

6 packages

found in

Top 1k

99 packages

found in

Top 10k

4.51M packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Top-level domains (TLD) are a part of the Domain Name System (DNS), and are used to lookup an Internet Protocol (IP) address of a requested website. There are a few different types of top-level domains. Generic, sponsored and country-code TLDs are generally accessible to the public. Registrars that govern the assignment of domain names within the TLD may choose to sell specific domain names to an interested party. However, some registrars are known to have less strict rules for assigning domain names. Attackers often abuse gaps in governance and actively seek to register their malicious domains in such TLDs. This issue is raised for all domains registered within TLDs that harbor an excessive number of malicious sites. While the presence of suspicious TLDs does not imply malicious intent, all of its uses in a software package should be documented and approved.

Prevalence in npm community

5 packages

found in

Top 100

14 packages

found in

Top 1k

248 packages

found in

Top 10k

254.62k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the top-level domain to avoid being flagged by security solutions.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in npm community

1 packages

found in

Top 100

2 packages

found in

Top 1k

66 packages

found in

Top 10k

2.88M packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Top behaviors

See all behaviors

Prevalence in npm community

Behavior often found in this community (Common)

7 packages

found in

Top 100

62 packages

found in

Top 1k

984 packages

found in

Top 10k

344.78k packages

in community

Prevalence in npm community

Behavior often found in this community (Common)

7 packages

found in

Top 100

40 packages

found in

Top 1k

645 packages

found in

Top 10k

86.51k packages

in community

Prevalence in npm community

Behavior often found in this community (Common)

5 packages

found in

Top 100

39 packages

found in

Top 1k

536 packages

found in

Top 10k

115.13k packages

in community

Prevalence in npm community

Behavior often found in this community (Common)

95 packages

found in

Top 100

726 packages

found in

Top 1k

7488 packages

found in

Top 10k

4.56M packages

in community

Prevalence in npm community

Behavior often found in this community (Common)

15 packages

found in

Top 100

52 packages

found in

Top 1k

615 packages

found in

Top 10k

153.81k packages

in community

Top vulnerabilities

No vulnerabilities found.

openpaw-graveyard

SAFE Assessment

Compliance

Security

Threats

FAQ for openpaw-graveyard

What is openpaw-graveyard?

Is openpaw-graveyard malicious or is it safe to use?

Is openpaw-graveyard popular?

How do I secure openpaw-graveyard once it is in my app?

Did you know...

Popularity

Top issues

TH30102Detected presence of software components that are quarantined in the community package index.Causes risk: quarantined components foundhunting

Problem

Prevalence in npm community

Next steps

TH15502Detected presence of files with behaviors similar to malicious packages published on NPM.Causes risk: suspicious application behaviorshunting

Problem

Prevalence in npm community

Next steps

TH30106Detected presence of software components that have low popularity or number of downloads.hunting

Problem

Prevalence in npm community

Next steps

TH17118Detected presence of files containing URLs that use suspicious top-level domains.hunting

Problem

Prevalence in npm community

Next steps

TH30107Detected presence of software components that are rarely included by other public software packages.hunting

Problem

Prevalence in npm community

Next steps

Top behaviors

Encodes data using the Base64 algorithm.packer

Prevalence in npm community

Opens URLs during installation or upon launch.network

Prevalence in npm community

Contains URLs that link to interesting file formats.network

Prevalence in npm community

Executes files during installation or upon launch.execution

Prevalence in npm community

Creates a process.execution

Prevalence in npm community

Top vulnerabilities