Malicious code in @wagni_bot/eth-agent (npm)

Source: amazon-inspector 08c234c984ea87a7d4c780dc8ddbc244926628e405ea0f7ac9798309260a6122 The package advertises itself as an 'Unofficial eth-agent SDK' but ships an empty main module index.js contains only module.exports = ; its sole runtime behavior is a postinstall lifecycle script that fires...

Malicious code in neon-poly-utls (npm)

Source: amazon-inspector 0d32a00f9baf3245d9fb2850131a024274a409ca0eb90ac9db6e3e7dc37d379f The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/config/clob-math.json, fetches that JSON to resolve a peer-bundle URL, downloads a.tgz t...

Malicious code in pp-react-v5 (npm)

pp-react-v5 is a dependency confusion package published at the inflated version 10.0.0 to win npm resolution over any internally-hosted package of the same name. The package contains only a package.json with no functional source code. On installation the preinstall script executes a wget command...

Malicious code in maplibre-gl-vue3 (npm)

Source: amazon-inspector a46347c152553bd008255683dd927e5f25233224d3c6f1df6ae87533350b5815 The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import it unconditionally injects a tag into document.head pointing at...

Malicious code in @checkrhq/adjudication-api-client (npm)

Source: amazon-inspector 8c52d9987ace09f0c48d8b0661bd1fcd3cf4e7e701b5e515810c7f32d99086cf package.json declares a preinstall lifecycle script that runs curl to POST installer reconnaissance data — hostname, current user whoami, working directory, and uid/gid id — to a hardcoded webhook.site...

Malicious code in clob-math-v2 (npm)

Source: amazon-inspector 4cd6b75c25c58b35cca1a29500c1608eb1b121e37bd9305ff549d05d73b69031 Package presents itself as a Polymarket CLOB math SDK but is published from a domain not owned by Polymarket polymarket-clob-service.vercel.app; the real project is polymarket.com. The postinstall script rea...

Malicious code in poly-kelly (npm)

Source: amazon-inspector 3d3df5266b6e9d9347844e4e054ab744aad9517c6f55df4e68e6c6815e843da7 On npm install, the package's postinstall script reads the homepage field from package.json set to https://data-stream.space/config/stake-math-sync.json, fetches that JSON config, extracts a peerBundle tarba...

Malicious code in @wagni_bot/bsc-sdk (npm)

Source: amazon-inspector 68707229cc80d6db8fe3b087a40601cdbd8b23bcda9a3030ede4e0ac85fe0cf8 @wagnibot/[email protected] is a typosquat of BSC-SDK-family packages whose sole purpose is credential theft at install time. index.js exports an empty object; the package provides no advertised BNB Smart Chain...

Malicious code in date-kit-lite (npm)

Source: amazon-inspector ce3951661e57807f08fd4dcbf281c14dd1e596907e1a356a3ec503e45fe3b8af The package advertises itself as a lightweight date-formatting utility but its postinstall lifecycle script executes the id command and transmits the output installer uid/gid/groups to a hardcoded bare-IP...

Malicious code in ledgerflow-deploy-utils (npm)

Source: amazon-inspector 5f0097d19be676ac30ff79dffcff38f128873c80115a8a150c3eceff0422aa93 On npm install, the package's postinstall script queries the AWS instance metadata service IMDSv1 at 169.254.169.254 for the attached IAM role and POSTs the result, along with an IMDS-reachability probe, ove...

Malicious code in fmt-date-lite (npm)

Source: amazon-inspector 1c8dad7bd90f4cb0dbb1d4ce933bc39f04aefe4940a53605e5c3f30c48a313e4 On npm install, the package's postinstall lifecycle script runs the id command and transmits the resulting user/group identity to a hardcoded bare-IP endpoint at http://155.190.124.243:6788/ over plain HTTP...

Malicious code in react-dom-v17 (npm)

Source: amazon-inspector f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29 Package name impersonates the widely-used react-dom package react-dom-v17. package.json declares preinstall: node index.js, which fires automatically on npm install. The preinstall script index.js shells out...

Malicious code in @meziizana/frontend-logger (npm)

Source: amazon-inspector a7d77255cb713e19b9560cc339e937518fdbfb49ab048d9d5a65ad81c1309a9a package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/f164a383-b9e7-4379-b18c-38bf41a3c152/ with query parameters carrying the installer's username $whoami, current...

Malicious code in gptcore (npm)

Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires automatically during npm install and launches mshta.exe against...

Malicious code in vuln-package (npm)

Source: amazon-inspector a8bd105bf3b12062f312b41f2a1eead5e8481f8d3749fc78bc79ed8675c11394 On npm install, the package's preinstall script triggers a DNS lookup to a unique subdomain of oast.fun fabekzbnjtufpffkzzmvjvi5eafhny3ok.oast.fun, an out-of-band interaction service, confirming code executi...

Malicious code in electron-orbit (npm)

Source: amazon-inspector 7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f On require'electron-orbit', the module unconditionally fires an auto-prefetch pipeline in Node contexts when no document is present that opens a raw node:net socket to electronorbit.blob.core.windows.net:443...

Malicious code in @espn-ping/react-dmed-oauth (npm)

Source: amazon-inspector 3bc0467ac62043cf22dd249a99ff1279646dc599702140998ff5b86c79645364 @espn-ping/[email protected] declares a preinstall lifecycle script node index.js /dev/null 2&1 that automatically executes on npm install. index.js shells out via childprocess.exec to collect the...

Malicious Package

Overview lucy-python-script-2030 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in @iana-rzms/bff-sdk (npm)

Source: amazon-inspector b7adbad0c719aec3345c5aa16b3435e8621f4a81b5a0e0cf0e0d979509e5d21f Package published to the public @iana-rzms scope as a dependency-confusion squat targeting an internal ICANN namespace. The preinstall lifecycle script runs automatically on npm install and collects the...

Malicious code in express-bunker (npm)

Source: amazon-inspector 68139b9a62e1d546de6ce2e46d5203782dbf54f1af2edbd2b8f509528eb0f000 [email protected] ships a postinstall script that performs an HTTP GET to a hardcoded bare IP over plain HTTP http://130.49.177.51:18080/p/dc-20260627-yandex-geobase at npm install time, transmitting the...