31 matches found
Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f The package's index.js unconditionally requires vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS...
Malicious code in pfp-forms-sme-registration-ooo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...
MAL-2026-12137 Malicious code in accounts-timeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on...
Malicious code in @lazyutil/dater (npm)
@lazyutil/dater malicious versions 0.8.1, 0.9.2, 0.9.3, and 0.9.4, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all...
MAL-2026-6209 Malicious code in @antoncarlos1/nodelamp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d930df8b6392b3bbfe3b591d90226374d31fb246e06018521f3f673a815b618a @antoncarlos1/[email protected] ships a single obfuscated index.js that runs a dropper on require. The top-level IIFE constructs a hardcoded IPv4 URL by...
Malicious code in @service-user-notifications/set_notifications_not_removable (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a890f1cd8313de802c1425ca5603b7d1fabaf84cb1e47b582a4633dae34ccf14 On npm install, scripts/postinstall.js fetches a platform-specific binary from https://oob.moika.tech/payload/linux|mac|win, writes it to a hidden te...
Malicious code in swift-optimizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c54f35da6df5cef65715d49fb7942aff442ee9a0cb486862031e5009277db3a On npm install, [email protected] runs scripts/install-binary.js as a postinstall hook. The script is a hand-rolled JavaScript bytecode VM 123 KB...
Malicious code in codebuff-cli (npm)
The npm package codebuff-cli impersonates the legitimate codebuff package README copied verbatim from the official CodebuffAI project and relays authenticated Codebuff traffic — API key, source code, context and chat messages — to an attacker-controlled backend instead of codebuff.com. These thre...
MAL-2026-4533 Malicious code in codebuff-cli (npm)
The npm package codebuff-cli impersonates the legitimate codebuff package README copied verbatim from the official CodebuffAI project and relays authenticated Codebuff traffic — API key, source code, context and chat messages — to an attacker-controlled backend instead of codebuff.com. These thre...
MAL-2026-4572 Malicious code in get-package-lint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383f22ab2e1e8bbb44a44fa3828710f476947837d0b38aa9266eafcbf9959261 Package name typosquats the popular get-package-type and reuses its README/exports verbatim, but adds "postinstall": "node utils.cjs" in package.json...
