Malicious code in shiftmarkets-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1628a8b4e8b6c4c117f2a38f7d69664950c1d5758772c64c2225f296f681c29 The package declares a postinstall hook that runs dist/recon.js on npm install. The script collects hostname, username, sudouser, homedir, cwd,...

Malicious code in @sapappgyver/appgyver-descriptors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9396712a6bf4b08219d9ed2066ebf8c25a7558b988b6d9bf1c9ae57349a4741 The package declares an install lifecycle script that runs node index.js, which requires lib/core.js; the same module is the package main, so the...

Malicious code in twilio-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea71d301e90ede6f86f259e827a1cb61ad0b4b0166b70281bdf7896f726eea31 On npm install, the package's postinstall script executes index.js, which collects host identifiers os.hostname, os.userInfo.username, os.homedir,...

MAL-2026-12813 Malicious code in twilio-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea71d301e90ede6f86f259e827a1cb61ad0b4b0166b70281bdf7896f726eea31 On npm install, the package's postinstall script executes index.js, which collects host identifiers os.hostname, os.userInfo.username, os.homedir,...

Malicious code in sc-font-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8c91edd839dd00f2e58ad9296742f8c3c5ff126523bbd8ed7561fef7c8516e The package's preinstall script runs automatically on npm install and collects installer-side identifiers — os.hostname, os.userInfo.username,...

MAL-2026-12509 Malicious code in @shiftmarkets/shift-exchange-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9a3ac8f48d96507de8b8495dfc844f6fb44ae7667ee571dab05fc7d8453551 On npm install, the package's postinstall hook scripts.postinstall: 'node dist/recon.js || true' automatically runs dist/recon.js, which collects the...

Malicious code in @shiftmarkets/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3149c40a7290d16b0247a1128a3e25ba1614e87e5c7261e486ce2e826ac66987 The package runs node dist/recon.js as a postinstall lifecycle script on every npm install. The script collects host reconnaissance from the installe...

Malicious code in appsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff26e8c679b4035612af78043157ee418aac37aab4eebc5ba54a6e60f204e95c Package name appsignal shadows the legitimate @appsignal/ scope and is published at version 9999.0.0, a version-number pattern used to outrank...

Malicious code in @cy4dev/cydemo-bg-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0 @cy4dev/[email protected] ships a postinstall lifecycle script src/postinstall.js that runs at npm install time and invokes node:childprocess.exe...

Malicious code in voicemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...

MAL-2026-12496 Malicious code in voicemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...

Malicious code in luluking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode numeric arrays,...

MAL-2026-12397 Malicious code in luluking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode numeric arrays,...

MAL-2026-12435 Malicious code in sc-geeksquad-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a [email protected] declares a preinstall script node callback.js that runs automatically on npm install. The script collects the installer's...

MAL-2026-12358 Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

MAL-2026-12395 Malicious code in jquery.ui.tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50fc48e6d03705244cf78a2f2ee23c6ffe5a91a64f98d23d6a31f94557bf0d84 [email protected] is a dependency-confusion squat: it is published at version 9999.0.0 with an empty runtime index.js contains only...

Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

MAL-2026-12394 Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

MAL-2026-12378 Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...