Malicious code in easy-day-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8602a5a154b50bb6351900a08fa45d7814c0f152e4379dcae53ccfa0b83db891 Package name 'easy-day-js' impersonates the popular 'dayjs' library, copying dayjs's author 'iamkun', homepage https://day.js.org, repository URL,...

Malicious code in cryptodao-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21c450a1d14c10213b83137f9c0670a9d8ed953105f96d66eedee78a56479d82 Package is published as version 99.99.99 to win private-vs-public resolution against an internal cryptodao-contracts namespace. The package's main...

MAL-2026-5975 Malicious code in cryptodao-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21c450a1d14c10213b83137f9c0670a9d8ed953105f96d66eedee78a56479d82 Package is published as version 99.99.99 to win private-vs-public resolution against an internal cryptodao-contracts namespace. The package's main...

MAL-2026-5976 Malicious code in cryptodao-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44bcbcde72a12ed60b3d16200226faa40f1e7e66c6ac36776710f2a0a3fec9a7 package.json declares a postinstall hook that runs recon.js on every npm install. recon.js harvests installer-side secrets — AWSSECRETACCESSKEY,...

Malicious code in cryptodao-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44bcbcde72a12ed60b3d16200226faa40f1e7e66c6ac36776710f2a0a3fec9a7 package.json declares a postinstall hook that runs recon.js on every npm install. recon.js harvests installer-side secrets — AWSSECRETACCESSKEY,...

MAL-2026-5974 Malicious code in cryptodao-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecefbb2ee777ab552f12fef0eab9af65f0a6c79f8a75a90f3df495a6746ec4a On npm install, the package's postinstall hook executes recon.js, which harvests installer-side data and POSTs it to attacker-controlled endpoints...

Malicious code in cryptodao-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecefbb2ee777ab552f12fef0eab9af65f0a6c79f8a75a90f3df495a6746ec4a On npm install, the package's postinstall hook executes recon.js, which harvests installer-side data and POSTs it to attacker-controlled endpoints...

Malicious code in cryptodao-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...

MAL-2026-5978 Malicious code in cryptodao-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...

Malicious code in cryptodao-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce8426b1d9dc5bde6547b58a21f2d3b519e56f7c2f948aa7e2173261532cee7 On npm install, the package's postinstall hook executes recon.js, which enumerates a hardcoded list of credential-bearing environment variables...

MAL-2026-5977 Malicious code in cryptodao-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce8426b1d9dc5bde6547b58a21f2d3b519e56f7c2f948aa7e2173261532cee7 On npm install, the package's postinstall hook executes recon.js, which enumerates a hardcoded list of credential-bearing environment variables...

Malicious code in @public-for-cdao/abi (npm)

The @public-for-cdao/abi package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10599 Malicious code in @public-for-cdao/abi (npm)

The @public-for-cdao/abi package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10600 Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10601 Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/config (npm)

The @public-for-cdao/config package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...