Single low-confidence YARA match 'python_exec_near_enough_decrypt' is insufficient to classify as malware given project popularity and provenance.
No verification record available.
The package @next/env version 16.0.5 from the vercel/next.js project, which has a substantial number of stars and forks, exhibits a YARA rule match python_exec_near_enough_decrypt in index.js. While this suggests the potential execution of encrypted content, it is a single piece of evidence with low confidence. Without further corroborating evidence, it is insufficient to classify the package as malware. The project's popularity and the presence of SLSA provenance also suggest a lower risk of malicious intent.
