Malicious code in pkg-fallback (npm)

Source: amazon-inspector c97ea590e70f499f40938e093cd6a09a13b95030872968b5d325fee8a595f31c Package advertises itself as a small string-manipulation library trim, case, pad, wrap but its install-time behavior is a dropper. package.json declares a direct dependency native-bridge as...

Malicious code in ts-clob-math-v2 (npm)

Source: amazon-inspector 99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9 On npm install, the postinstall script scripts/install-check.cjs resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.app with env-var overrides PSMPEERURL / PSMSYNCCONFIG /...

Malicious code in test-pkg-pnpm (npm)

Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo platform-branches via execSync to open...

Malicious code in ts-elinter (npm)

Source: amazon-inspector ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767 On npm install, the package's postinstall script scripts/install-check.cjs fetches a JSON pointer from https://trabalhos-flax.vercel.app/config/clob-math.json, downloads the referenced.tgz to a temp director...

Malicious code in polymarket-risk-manager (npm)

Source: amazon-inspector 54bfddce038bb64117d6850bb2977f8cee17704212e12e6214fb495b9d4cee79 On npm install, the package's postinstall script reads a config URL from package.json's homepage field https://parket-server-help.vercel.app/config/psm-peer.json, downloads a tarball from the returned bundle...

Malicious code in @marketfront/infopopup (npm)

The @marketfront/infopopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

Malicious code in @k18n/creatormarketplace-admin-language (npm)

Source: amazon-inspector 6213acbcf6c562c8a7690e6018490d502d8df9377a2ed85c5bca9d828ed261c8 Package claims the @k18n npm scope used internally by Kuaishou and publishes at version 99.0.0 — the canonical high-version dependency-confusion shape that causes internal builds resolving @k18n from public...

Malicious code in ec-checker (npm)

Source: amazon-inspector dc8245936c8beb04bdb2bfe31a8117133823e3ffd6ed3e165d89b822dfab4a9c package.json declares a preinstall script that runs npm install @sentry/node && node examples/verify.js. examples/verify.js initializes the package's Sentry client against a hardcoded author-owned DSN...

Malicious code in @marketfront/devtoolsloader (npm)

The @marketfront/devtoolsloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

Malicious code in yandex-geobase (npm)

Source: amazon-inspector 1f6219d513896736aee31ce33719d6ae2d1f5b03293ecdfe884d944bbb3eb99a [email protected] squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTTP GET to a hardcoded bare-IP endpoint...

Malicious code in testing-d3do (npm)

Source: amazon-inspector 6c008bcf9a72a02f11c556396a39d6de999bfad0cfa389ddac01929d19bb34d8 On npm install, this package's postinstall script collects host identifiers os.hostname, os.userInfo, current working directory, and external IPv4 address and POSTs them to a hardcoded subdomain under oast.f...

Malicious code in polymarket-trading-developer-tool (npm)

Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at pm-trading-dev-tools-be.vercel.app/config/clob-math.json the package...

Malicious code in polymarket-kelly-math (npm)

Source: amazon-inspector f4b668f5fa9e3cce1dd0ddee31443ff3e797c19e9343b750dee86ddef888b02a The package's postinstall script scripts/install-check.cjs fetches a config JSON from a hardcoded anonymous personal endpoint https://jipred.vercel.app/config/clob-math.json, reads a.tgz bundle URL from that...

Malicious code in domains-billing-types (npm)

Source: amazon-inspector 4860726efc056e319a24e46ac4e179809cc294267679a9b8122c5205b49369f1 [email protected] executes node index.js from its postinstall lifecycle script. On install, index.js reads os.hostname and os.userInfo.username and embeds them as subdomain labels in a DNS A-reco...

Malicious code in polymarket-kelly-maths (npm)

Source: amazon-inspector dc23601d9ca932f0a36a1a6e7115e37da1e984b1adf3b39b9612b72f5a3cf90f The package's postinstall script install-check.cjs resolves a bundle URL from a remote JSON config at https://jipred.vercel.app/config/clob-math.json derived from package.json homepage, downloads a.tgz bundl...

Malicious code in webrix-docs (npm)

Source: amazon-inspector bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host reconnaissance data — os.hostname, os.userInfo username, uid, gid, homedir, process.platform,...

Malicious code in clob-client-math (npm)

Source: amazon-inspector b36bbf14a743630a93ba7f8d7529d3fae8073f0f585af4343506be6248fc1b59 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from https://polymarket-clob-service.vercel.app/config/clob-math.json, reads a peerBundle tarball URL from the...

Malicious code in clob-math-v2 (npm)

Source: amazon-inspector 4cd6b75c25c58b35cca1a29500c1608eb1b121e37bd9305ff549d05d73b69031 Package presents itself as a Polymarket CLOB math SDK but is published from a domain not owned by Polymarket polymarket-clob-service.vercel.app; the real project is polymarket.com. The postinstall script rea...

Malicious code in @wagni_bot/eth-agent (npm)

Source: amazon-inspector 08c234c984ea87a7d4c780dc8ddbc244926628e405ea0f7ac9798309260a6122 The package advertises itself as an 'Unofficial eth-agent SDK' but ships an empty main module index.js contains only module.exports = ; its sole runtime behavior is a postinstall lifecycle script that fires...

Malicious code in pp-react-v5 (npm)

pp-react-v5 is a dependency confusion package published at the inflated version 10.0.0 to win npm resolution over any internally-hosted package of the same name. The package contains only a package.json with no functional source code. On installation the preinstall script executes a wget command...