MAL-2026-16311 Malicious code in test12vv36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be [email protected] declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a...

MAL-2026-16116 Malicious code in etoro-builders (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9210fb131a2f661ae1d656fa461d45c6c54377179aecba06e6a07b4f357a00b The package's preinstall lifecycle script preinstall.js reads the installer's OS hostname, username, and current working directory via os.hostname,...

MAL-2026-14523 Malicious code in rce-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c27b8e593dc0298e09bb4a5fd6acc68dc03bf324bdc7267e87482fdd10b0fa2d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in sm-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2741ebbd0df8c6f349a4d34361cc3d814fe878f3f4521fd771a855cfdc152b Package [email protected] defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardcoded bare-IP endpoint at...

Malicious Package

Overview typescriptjs is a malicious package. This is a "typosquatting" package, which means the package name is based on existing repositories, namespaces, or components, it aims to trick users to download the package which contains a malicious code. Payload behavior The malicious payload runs...

MAL-2025-191695 Malicious code in browser-history-analytics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1ac674eaa856956dea531487502bd21a51f5324bdfcaf788645bbbb41eb27f5 When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

Malicious code in spiderai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cfee8e74f278d45135c11ee4ff3f18180cb2423e333934a8ba994f5e8ec48b9a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...