Is app-soda-layer 2.1.6 malicious? — flagged suspicious by Protet

Q: Is app-soda-layer 2.1.6 malicious?

Protet's sandbox detonated app-soda-layer 2.1.6 (npm) and flagged it as suspicious — its observed behaviour at install and run time is consistent with malicious activity. This is automated analysis of a public package and may include false positives; it is not a definitive determination.

← All analysed packages

npm package

app-soda-layer

version 2.1.6 · detonated 2026-07-27 · isolated sandbox

⚠ Flagged as suspicious

Suspicious command chain

node /usr/local/bin/npm install --no-audit --no-fund

node test.js

sudo chown -R det:det /home/det/.ssh

esbuild --version

node /tmp/detonate.Dk1VVL/node_modules/.bin/vite build

esbuild --service=0.21.5 --ping

What it did

Resolved 1 domain(s) during install.
registry.npmjs.org
Read 4 sensitive path(s).
/etc/passwd/home/det/.npmrc/home/det/.ssh/authorized_keys/tmp/detonate.Dk1VVL/.npmrc

Protet continuously detonates newly-published npm packages in an isolated sandbox and scores what they actually do at install and run time. app-soda-layer 2.1.6 was flagged as suspicious on the strength of the behaviour above — its observed behaviour is consistent with malicious activity. This is automated analysis of public packages and may include false positives; it is not a definitive determination. Browse every package we've flagged.