CVE-2025-1974_IngressNightmare_PoC

CVE-2025-1974IngressNightmare poc IngressNightmare Script A Python script to automate sending JSON payloads to a list of IPs via curl, capturing responses and splitting them into success and failure XML reports. Features Sends HTTPS POST requests with a JSON payload to multiple IP addresses...

Malicious code in @coopeuch/config (npm)

Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope registry when an organization's scope-to-registry mapping...

Malicious code in fa-mcp-sdk (npm)

Source: amazon-inspector 62142cbcb6da6a6c078dd91a92cc28d8cfa30a9f4fc901ab2cdbc4cfd6540abb The package includes cli-template/update.cjs, an update helper that combines several install/update-time capabilities: it imports childprocess, https, fs, and os; reads os.hostname and other system...

Malicious code in @zzzgenesis00/crypto-config (npm)

Source: amazon-inspector 0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3 postinstall.js runs automatically on npm install and enumerates installer-owned secret material: SSH private keys under /.ssh, /.npmrc, /.gitconfig, Chrome/Firefox profile cookie/login/key databases,...

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

Malicious code in chapters-core (npm)

Source: amazon-inspector e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992 The package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.hostname, os.userInfo.username, process.cwd, and CI/CD attribution environment variables...

Malicious code in fundraiserservpp (npm)

Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machine — os.hostname, os.platform, os.arch, the user home...

Malicious code in wolverinechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ad1c6bad5ee8d3cb562503b94d5534ba2c98ad5b4854c073e1482d59ab8687e package.json declares a preinstall hook that runs index.js during npm install. The script reads /etc/passwd, /etc/hosts, os.hostname,...

MAL-2026-12669 Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...

Malicious code in viem-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32 The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey...

Malicious code in forge-extended (npm)

Source: amazon-inspector 3784f08ba715b7afbeecfaa10b9c953b4406770c976bd07200977fa2f80b0317 On npm install, the package's preinstall script index.js collects installer-side system data — os.hostname, os.userInfo.username, home directory, DNS server list, and package metadata — reads /etc/passwd and...

Malicious code in aedes_clusters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560 The package's package.json declares a preinstall: node index.js hook that fires automatically on npm install. index.js collects host reconnaissance...

Malicious code in @marketfront/designsystemdevtool (npm)

The @marketfront/designsystemdevtool package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and...

Malicious code in @marketfront/fashiononboardingpopup (npm)

The @marketfront/fashiononboardingpopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0...

Malicious code in @marketfront/dynamicpageparams (npm)

The @marketfront/dynamicpageparams package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and u...

Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in @access-risk/browser-remedy-react (npm)

Source: amazon-inspector 0de4bc9f19feea718e091e9b0a480e9b939cdffa88109375020895c99efa489c On npm install, postinstall.js executes automatically and collects host identity and environment details using os.hostname, process.cwd, and filesystem reads, base64-encodes the data via...

Malicious code in tinyparrot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9 The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays v...

MAL-2026-7000 Malicious code in pipo-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 259159c0505b819905dcaf53172d98a4fd590a9ae1a40f87d2be4c1a7fdc4065 This package is a dependency-confusion payload published at an abnormally high version 9999.0.0 targeting an internal package name pipo-sdk. The...

Malicious code in @marketfront/errorcounter (npm)

The @marketfront/errorcounter package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...