Malicious code in dependencyfsdsfdsfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab package.json declares postinstall: node index.js, causing index.js to run automatically on npm install. The script collects the installer's username...

MAL-2026-13770 Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...

Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...

vigolium v0.3.10

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

Malicious code in @cats-cdf/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 404569337a1e5fc46fff2584e052d2f9f99c3cb8d04e5fb3b5c5d633c178e01c The package's preinstall lifecycle script runs on npm install and collects the installer's local username whoami, hostname, and public IP address...

MAL-2026-13478 Malicious code in @cats-cdf/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 404569337a1e5fc46fff2584e052d2f9f99c3cb8d04e5fb3b5c5d633c178e01c The package's preinstall lifecycle script runs on npm install and collects the installer's local username whoami, hostname, and public IP address...

MAL-2026-13479 Malicious code in @cats-cdf/browser-metrics-meter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83df5c7e17dd2b9a808bddee17deb157e88a12632a632177f7969fce9ccfa7a8 The package's preinstall lifecycle script runs automatically on npm install and executes whoami and hostname, then fetches the machine's public IP fr...

Malicious code in karapace-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686 The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home directory, DNS server list,...

MAL-2026-12201 Malicious code in simple-date-formatter-util-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdd747d615be16a4af8508b6151d829c49f8ba2e1d045b8c1cbc9d8f2f219de9 package.json declares a postinstall script that, on npm install, collects installer reconnaissance id, hostname, uname, cgroups, docker.sock, Linux...

Malicious code in simple-date-formatter-util-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe9863d2e47d22ca16f42efd68d0c79e0b2730b48984bf68b040f6f920fb70ec Package presents itself as a date-formatting utility index.js is a four-line toLocaleDateString wrapper but its package.json postinstall hook runs an...

vigolium v0.3.5

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

Apache Log4j2 Remote Code Injection

Apache Log4j2 =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when...

Malicious code in leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b0bed6337ffe527af2615fed8ae1ecbb449f6a6cb00afa6381f7811ec88956 [email protected] ships src/poc/index.js which uses childprocess.exec to run a shell pipeline that collects host reconnaissance data hostname,...

Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

MAL-2026-10625 Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

Malicious code in bimi-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo...

MAL-2026-10212 Malicious code in vuln-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8bd105bf3b12062f312b41f2a1eead5e8481f8d3749fc78bc79ed8675c11394 On npm install, the package's preinstall script triggers a DNS lookup to a unique subdomain of oast.fun fabekzbnjtufpffkzzmvjvi5eafhny3ok.oast.fun, a...

Malicious code in consumerweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance os.hostname, os.userInfo.usernam...

MAL-2026-10086 Malicious code in dl-pp-latm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e21f1adb71c41838848c4d4292830a9738895d32a5b0f1f098e1efdadb233716 Package [email protected] registers both preinstall and postinstall lifecycle hooks that run index.js, which collects installer machine identifiers —...

MAL-2026-10006 Malicious code in testing-d3do (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c008bcf9a72a02f11c556396a39d6de999bfad0cfa389ddac01929d19bb34d8 On npm install, this package's postinstall script collects host identifiers os.hostname, os.userInfo, current working directory, and external IPv4...