rev-dep

Rev-dep Capabilities • Installation • Documentation • Exploratory Toolkit • Newsletter Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI. About 📣 As codebases scale, maintaining...

sshtunnel

|Tests| |AppVeyor| |readthedocs| |coveralls| |version| |pyversions| |license| Author : Pahaz Repo : https://github.com/pahaz/sshtunnel/ Inspired by https://github.com/jmagnusson/bgtunnel, which doesn't work on Windows. See also: https://github.com/paramiko/paramiko/blob/master/demos/forward.py...

Malicious code in nitro-bundled-dep (npm)

Source: amazon-inspector 0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5 [email protected] ships a stub main module a Proxy that no-ops any property access plus beacon.cjs, which runs both from the postinstall lifecycle hook node beacon.cjs and on top-level require of...

Malicious code in liferay-workspace-scripts (npm)

Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz instead of a registry version range. On npm install, npm...

Malicious code in ksp-client-registry (npm)

Source: amazon-inspector 3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018 The npm package [email protected] ships a prebuilt native addon at prebuilds/linux-x64/addon.node that is loaded by the package main index.js require of./prebuilds/linux-x64/addon. On load the...

Malicious code in ksp-app (npm)

Source: amazon-inspector b14a9fbd9fc1a48dc3ac0498f9606cecb1a56bad912c7f8a818fad332ef9ad15 [email protected] is a dependency-confusion-shaped npm package whose only payload is an opaque prebuilt Linux x64 native addon loaded at install time. package.json declares scripts.postinstall="node...

Malicious code in react-paginate-v5 (npm)

Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an implausibly high version 99.0.0 to win resolution against an...

Malicious code in @coopeuch/common (npm)

Source: amazon-inspector 887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59 @coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version 1.999.999 consistent with the dependency-confusion technique that outranks...

Malicious code in @coopeuch/core (npm)

Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home directory, platform/arch/release, CPU and memory, DNS servers,...

Malicious code in @coopeuch/button (npm)

Source: amazon-inspector ee1a3bb0818d46a9c83659ed32f8ab209477970658d5f6f8241a12c96d137c98 The package's postinstall lifecycle script postinstall.js runs automatically on npm install and harvests installer host identifiers — hostname, username, uid/gid, home directory, non-internal network...

Malicious code in @coopeuch/components (npm)

Source: amazon-inspector 042f083be94ae23751c73b5a73c0f11e4e9ecafd9ee9f1caa8c05b367ac71de8 The package declares a postinstall script postinstall.js that runs automatically on npm install and collects a broad set of installer-side identifiers: hostname, username, uid/gid, home directory, platform,...

laforge

Laforge Marco de automatización de infraestructura para competiciones de seguridad Laforge permite el desarrollo rápido de infraestructura para competiciones de seguridad informática. Mediante un lenguaje de configuración simple e intuitivo, Laforge gestiona un grafo de dependencias y el estado d...

MAL-2026-17763 Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

MAL-2026-17761 Malicious code in @coopeuch/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 042f083be94ae23751c73b5a73c0f11e4e9ecafd9ee9f1caa8c05b367ac71de8 The package declares a postinstall script postinstall.js that runs automatically on npm install and collects a broad set of installer-side identifier...

MAL-2026-17878 Malicious code in util-foriepft (npm)

[email protected] was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through childprocess and sends thei...

Malicious code in @s4yhiitestpoc/scan-https-d (npm)

Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...

MAL-2026-17766 Malicious code in @s4yhiitestpoc/scan-https-d (npm)

Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...

Malicious code in @coopeuch/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59 @coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version 1.999.999...

MAL-2026-17760 Malicious code in @coopeuch/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59 @coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version 1.999.999...