MAL-2026-14434 Malicious code in openai-pr-reviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3553acd3c5abc3f71b55740c4b06b2eb278f81bb678c55211f2287a498b60b61 The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS servers, current working director...

burp-ai-agent v1.0.0

Custom AI Agent The bridge between Burp Suite and modern AI. A note on the name: This extension is published as Custom AI Agent formerly Burp AI Agent. It was renamed to comply with PortSwigger's BApp Store naming requirements and to avoid confusion with Burp Suite's built-in Burp AI provider. Th...

Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

Malicious code in optimizely-starter-kit-for-fastly-compute (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...

MAL-2026-14139 Malicious code in prism-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6570c9056bf020fdada0366045c4e91a0f5cb21171fe27df9fcea82259e7809 The package declares preinstall: "node index.js", which fires automatically on npm install. index.js collects host identifiers os.hostname,...

Security-Learning-Notes

Personal Cybersecurity Training Repository Repository Descr...

Malicious code in nc-verify-127942 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ea69188e179cd73aa9f200d63e8faceb5d3aae622a8fe2d86bf7ae761b5f1e0 nc-verify-127942 declares a postinstall lifecycle hook "postinstall": "node install-cb.js" that runs automatically on npm install. The install-cb.js...

MAL-2026-13965 Malicious code in nc-verify-127942 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ea69188e179cd73aa9f200d63e8faceb5d3aae622a8fe2d86bf7ae761b5f1e0 nc-verify-127942 declares a postinstall lifecycle hook "postinstall": "node install-cb.js" that runs automatically on npm install. The install-cb.js...

Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...

MAL-2026-13952 Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...

Malicious code in ai-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...

MAL-2026-13934 Malicious code in ai-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...

MAL-2026-13922 Malicious code in passkeys-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cce50db3ac46a97bd27f546d029617582b37a2ead027509b0bea35370e47d2bd package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, curre...

MAL-2026-13754 Malicious code in dependencyfsdsfdsfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab package.json declares postinstall: node index.js, causing index.js to run automatically on npm install. The script collects the installer's username...

Malicious code in dependencyfsdsfdsfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab package.json declares postinstall: node index.js, causing index.js to run automatically on npm install. The script collects the installer's username...

MAL-2026-13549 Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

Malicious code in @wbnr/frontend-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username...

Malicious code in content-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5656ce6bbda8526587e40810d90b3188e11d507ebb13168203384bfac6b5ec1b [email protected] declares a preinstall lifecycle script in package.json that executes node -e to perform an HTTP GET to a unique subdomain of...

Malicious code in dlab_workshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452b525d6d3fc409e081d5f8a6f052c7b3b9899d1f088a24d93e4be4de65c9cf The package's index.js reads installer-owned secret files from the home directory /.ssh/idrsa, /.ssh/ided25519, /.ssh/config, /.aws/credentials,...