Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

Malicious code in token-list-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0c4aa27fc6318b8e3b7e2ec6718d3254147df0032799c5667dd8e88a24ca188 On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname, os.userInfo.username, and...

Malicious code in @shiftmarkets/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82 The package declares a postinstall script node dist/recon.js that runs automatically on npm install. The script collects installer-side reconnaissanc...

Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

Malicious code in @cryptosrvc/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host...

Malicious code in crypto-javas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8df6a7a735756b97bf8957dfacf2076f6ea39d4fdc8489755ea14e8c89f9c1 [email protected] registers a postinstall hook "postinstall": "node setup.js" in package.json and a top-level autoExecute in the main index.js that...

Malicious code in rpc-endpoint-rotator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname,...

Malicious code in shift-sdk-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aca555e012d36b30d9ffe3d0f8acdca7ba67298a87ea02ea9d32731e8f2a748 [email protected] registers a postinstall script that runs dist/recon.js on npm install. The script collects hostname, username, SUDOUSER, home...

Malicious code in com.db.dbk.ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c74649b28994f970d4972ffb8708378b355186eb729bf2e4c45d6acd16346e5d [email protected] is a version-inflated package published to the public npm registry under a scope that resembles an internal namespace. Its...

Malicious code in @offa/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8 package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname, os.userInfo.username, process.cwd, and the...

MAL-2026-12313 Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

MAL-2026-12411 Malicious code in pfp-block-mobile-vacancy-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5 On require of the package, index.js loads loader.js which unconditionally executes init. init selects an OS-specific payload path, downloads an opaqu...

Malicious code in streak-math-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...

Malicious code in pfa-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or...

Malicious code in streak-daily-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea29201e3cd49e11201222e430bd1787a1b00abdc46fad18908d0033459ed2d7 [email protected]'s main entry index.mjs runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to...

Malicious code in eth-crypto-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4766af8f78c9d0a3836222bd3986232b5e49086285f88d93e5c3044e3b75600 On require of index.js, the package initiates an HTTPS POST to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/beacon carrying a JSON...

MAL-2026-12451 Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf The package presents itself as a Keycloak typed client but on require executes a binary dropper. index.js loads adapter.js, which reconstructs...

Malicious code in sme-crm-services-sme-crm-services-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ec89cd09f6d62ee7e1a0e509712ee53f41f3ebba4139453cf1e3a1080fe3c9 On require of the package, index.js loads vendor.js which selects an OS/architecture-specific URL path, downloads an opaque binary over HTTPS from...

Malicious code in sui-migration-audit-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc8cd463940a0fe70eee979bd85b9ea41eed627f30cf96be8e0174c9106c7e1 The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan routine copies /.sui/sui.keysto...

MAL-2026-12472 Malicious code in sui-migration-audit-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc8cd463940a0fe70eee979bd85b9ea41eed627f30cf96be8e0174c9106c7e1 The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan routine copies /.sui/sui.keysto...