redi

redi Automated redirector setup compatible with HTTP RATs CobaltStrike Beacon, meterpreter, etc, and CobaltStrike DNS Beacon. The script can either set up nginx reverse proxy, or DNS proxy/forwarder using dnsmasq. If HTTPS was selected, it will automatically setup letsencrypt certbot and obtain...

Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It collects os.hostname, the local username, platform/arch, Node...

MAL-2026-18105 Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It...

WEASEL

WEASEL: A Stealthy DNS Beacon WEASEL is a small in-memory implant using Python 3 with no dependencies. The beacon client sends a small amount of identifying information about its host to a DNS zone you control. WEASEL server can task clients to execute pre-baked or arbitrary commands. WEASEL is a...

Malicious code in pay-methods-kmf (npm)

Source: amazon-inspector 07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2 [email protected] is a trivial stub empty index.js, manifest description 'Frontend utilities' that ships a prebuilt Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it from...

Malicious code in @coopeuch/config (npm)

Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope registry when an organization's scope-to-registry mapping...

Malicious code in @coopeuch/common (npm)

Source: amazon-inspector 887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59 @coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version 1.999.999 consistent with the dependency-confusion technique that outranks...

MAL-2026-17776 Malicious code in pay-methods-kmf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2 [email protected] is a trivial stub empty index.js, manifest description 'Frontend utilities' that ships a prebuilt Linux x64 native addon ...

Malicious code in @coopeuch/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope...

MAL-2026-17160 Malicious code in simple-date-formatter-new-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe2adf4e9d3b54b33c0e80285a5b0eb4d81dfde75c7a5b7a202ac43793268cd The package presents itself as a date-formatting utility index.js is a 160-byte formatDate stub but the published tarball contains an SSH-key...

Malicious code in simple-date-formatter-new-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe2adf4e9d3b54b33c0e80285a5b0eb4d81dfde75c7a5b7a202ac43793268cd The package presents itself as a date-formatting utility index.js is a 160-byte formatDate stub but the published tarball contains an SSH-key...

Malicious code in @baanx/solana-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...

MAL-2026-16300 Malicious code in @baanx/solana-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...

Malicious code in @insiderintelligence/googleadmanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...

MAL-2026-16290 Malicious code in @insiderintelligence/googleadmanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...

Malicious code in easypanel-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb103b6863369372ba8c07701264f8b0f6b57e3217e07912c8efbd9371c648f The package's preinstall lifecycle script preinstall.js executes automatically on npm install and collects the installer's hostname, OS username,...

MAL-2026-16071 Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

Malicious code in easypanel-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8 The package's preinstall lifecycle script runs automatically on npm install and collects installer-side identifiers — os.hostname,...

Malicious code in easypanel-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cef6da51fcc215c514680417cfd3bacb5725b91a5b4a058fd6d2b161106209b0 The package ships an empty library body index.js exports and a preinstall lifecycle script that runs automatically on npm install. The preinstall...