Malicious code in @prime0/pcomatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816 index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On npm install, the...

MAL-2026-16192 Malicious code in strapi-plugin-weccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4a6e3de6177f265d44cf7317b020dbaed43907a0ed75b05ae0fe4eebaab469 The package's postinstall.js also declared as main executes automatically on npm install and performs bulk host reconnaissance and credential theft...

MAL-2026-16191 Malicious code in strapi-plugin-uicc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d393f18bab3c8fe1d9bea2d425d24d385657785e23cc053ac5e2c1c322f75129 postinstall.js is registered as both the npm postinstall hook and the package main. On install it polls os.hostname every 3 seconds and, when the...

MAL-2026-16189 Malicious code in strapi-plugin-sucresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33561abeab9c7a0c81c1b8aac01248b757234008d03e94dfc72817fa3078f17d [email protected] declares a postinstall lifecycle hook node postinstall.js that runs automatically on npm install. The postinstall...

MAL-2026-16151 Malicious code in sql-limit-enforcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is...

Malicious code in sql-limit-enforcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is...

Malicious code in concierge-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b The package's declared postinstall script executes exfilv2.js at npm install time. That script harvests the full process environment, current working...

Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

MAL-2026-16154 Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

MAL-2026-16097 Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...

Malicious code in @yongot/canary-mcp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578 Package @yongot/[email protected] ships beacon.js which runs execSync'id', reads os.hostname, and issues an HTTPS GET to a hardcoded webhook.site...

MAL-2026-16062 Malicious code in @yongot/canary-mcp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578 Package @yongot/[email protected] ships beacon.js which runs execSync'id', reads os.hostname, and issues an HTTPS GET to a hardcoded webhook.site...

Malicious code in @aspect-adv-ui/consent-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...

MAL-2026-16050 Malicious code in @aspect-adv-ui/consent-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...

Malicious code in puppeteer-obscura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5617ac5e060d08fcfe23669c497e6b4fbb8587fd7f7630a7b9f6e86287880983 On npm install, the package's postinstall hook node dist/install.js downloads a platform-specific binary from...

MAL-2026-16001 Malicious code in puppeteer-obscura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5617ac5e060d08fcfe23669c497e6b4fbb8587fd7f7630a7b9f6e86287880983 On npm install, the package's postinstall hook node dist/install.js downloads a platform-specific binary from...

Malicious code in real-router-telemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78bc9af22f0b3feafc2dbd863d7ce4b9ba26418ab58e87bc231123004a40a450 Package ships telemetry.js, an obfuscated module string-array accessor pattern hiding identifiers and the destination that reads host identity...

MAL-2026-15924 Malicious code in real-router-telemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78bc9af22f0b3feafc2dbd863d7ce4b9ba26418ab58e87bc231123004a40a450 Package ships telemetry.js, an obfuscated module string-array accessor pattern hiding identifiers and the destination that reads host identity...

Malicious code in 2nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d The package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^SECRET|API|TOKEN|KEY/, JSON-serializes the...

MAL-2026-15911 Malicious code in 2nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d The package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^SECRET|API|TOKEN|KEY/, JSON-serializes the...