Malicious code in @greenlake/session (npm)

Source: amazon-inspector 3255cc4148a62c7ba090d1912d41c572f3ce7ccb6db9cc131132cfd4a0970f43 The package is a scoped-namespace shim version 99.0.1 whose main entry re-exports a Proxy returning no-op functions, allowing consumer builds to resolve this name without errors. On npm install postinstall...

Malicious code in @greenlake/session (npm)

@greenlake/session is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 99.0.1, 1.0.0, 2.0.0 has a postinstall script that runs node beacon.cjs on...

MAL-2026-18283 Malicious code in @greenlake/session (npm)

@greenlake/session is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 99.0.1, 1.0.0, 2.0.0 has a postinstall script that runs node beacon.cjs on...

Malicious code in @ecg-internal/reviews-dialog-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d077157e19fb33158004d020ab55ba68751851a9dbab6a010064a83b8436c4 The npm package @ecg-internal/[email protected] is a dependency-confusion payload targeting an internal @ecg-internal/ scope. package.json...

MAL-2026-18211 Malicious code in @ecg-internal/reviews-dialog-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d077157e19fb33158004d020ab55ba68751851a9dbab6a010064a83b8436c4 The npm package @ecg-internal/[email protected] is a dependency-confusion payload targeting an internal @ecg-internal/ scope. package.json...

Malicious code in @conduitops/logview-archive (npm)

Source: amazon-inspector f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009 On install, package.json's postinstall hook runs install.js, which invokes npm install @conduit/[email protected] --registry where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.js...

Malicious code in @conduitops/logview-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009 On install, package.json's postinstall hook runs install.js, which invokes npm install @conduit/[email protected] --registry where the registry URL i...

MAL-2026-18183 Malicious code in @conduitops/logview-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009 On install, package.json's postinstall hook runs install.js, which invokes npm install @conduit/[email protected] --registry where the registry URL i...

Malicious code in @sudobility/testomniac_client (npm)

Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com using an embedded A...

Malicious code in @sudobility/indexer_client (npm)

Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/ a presigned S3 URL embedding...

Malicious code in @sudobility/shaperouter_client (npm)

Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com using a presigned URL embedded AWS access key id ,...

Malicious code in @sudobility/wildduck_client (npm)

Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 URL amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

MAL-2026-18129 Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...

Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...

MAL-2026-18127 Malicious code in @sudobility/indexer_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...

Malicious code in @sudobility/indexer_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...

MAL-2026-18130 Malicious code in @sudobility/wildduck_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 U...

Malicious code in @sudobility/wildduck_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 U...

MAL-2026-18128 Malicious code in @sudobility/shaperouter_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

Malicious code in @sudobility/shaperouter_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...