CVE-2025-55349

CVE-2025-55349 — Ejecución de código arbitrario en pm2 mediante postinstall Descubridor : Golden Ticket Labs Proveedor : Unitech pm2 Fecha de asignación : 20 de agosto de 2025 MITRE Descripción Un problema en el componente lib/API/Modules/NPM.js de Unitech PM2 v5.4.2 permite la ejecución de códig...

Malicious code in @umschool/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...

MAL-2026-16051 Malicious code in @umschool/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...

Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

Malicious code in @stellarshift/chain-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...

MAL-2026-15822 Malicious code in @stellarshift/chain-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...

Malicious code in cminhouse-api-gateway-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...

Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

MAL-2026-15565 Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

MAL-2026-14476 Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

Malicious code in ecobee-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...

Malicious code in @medisend/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28 package.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname via $hostname as a query...

MAL-2026-14423 Malicious code in @medisend/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28 package.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname via $hostname as a query...

Malicious code in @medisend/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the...

MAL-2026-14421 Malicious code in @medisend/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the...

Malicious code in @medisend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...

MAL-2026-14422 Malicious code in @medisend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...