CVE-2025-55349

CVE-2025-55349 — pm2 Arbitrary Code Execution via postinstall Discoverer : Golden Ticket Labs Vendor : Unitech pm2 Date Assigned : August 20, 2025 MITRE Description An issue in the lib/API/Modules/NPM.js component of Unitech PM2 v5.4.2 allows arbitrary code execution by installing packages with...

Malicious code in black-spindle-2 (npm)

Source: amazon-inspector 433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90 package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embedding a shell command-substitution expression in the URL path...

MAL-2026-18370 Malicious code in mw-communication-client (npm)

mw-communication-client was published to npm on 2026-10-27 from 06:55:13 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 10.0.0, 1.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

MAL-2026-18371 Malicious code in mw-test-utils (npm)

mw-test-utils was published to npm on 2026-10-27 from 06:56:36 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0, 10.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

MAL-2026-18369 Malicious code in mui-wrapper-x-date-pickers (npm)

mui-wrapper-x-date-pickers was published to npm on 2026-10-27 from 06:55:20 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

MAL-2026-18358 Malicious code in @testsecuiitytestme/cache-helper (npm)

This package installs a credential stealer and self-spreading worm. On a developer machine it exits under CI, in containers and under a debugger, the install script loads a prebuilt native addon that decodes and runs a hidden, obfuscated Bun program. That program collects npm, GitHub, GitLab, PyP...

Malicious code in mw-communication-client (npm)

mw-communication-client was published to npm on 2026-10-27 from 06:55:13 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 10.0.0, 1.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environmen...

Malicious code in mui-wrapper-x-date-pickers (npm)

mui-wrapper-x-date-pickers was published to npm on 2026-10-27 from 06:55:20 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in mw-test-utils (npm)

mw-test-utils was published to npm on 2026-10-27 from 06:56:36 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0, 10.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

MAL-2026-18372 Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in @testsecuiitytestme/cache-helper (npm)

@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 12:28 UTC, 1.0.2 15:33 UTC and 1.0.3 16:24 UTC; a 1.0.0 was removed before 14:21 UTC. It...

MAL-2026-18373 Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environmen...

Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environmen...

Malicious code in @webapp-shared/login-vmok (npm)

@webapp-shared/login-vmok is a dependency-confusion package: it uses the @webapp-shared scope, which matches a private internal package scope, and was published on 2026-10-27 in versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0 and 99.0.1 so that builds resolving the internal name from the public regist...

Malicious code in csvflow-schema (npm)

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" index.js exports a small validateSchema function and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and...

Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...