MAL-2026-15638 Malicious code in test__123q2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386 On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an...

MAL-2026-15632 Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

Malicious code in test__123q1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6 The package declares a postinstall hook node dist/script.js while its declared main entry dist/index.js is an inert 105-byte stub, so the entire...

MAL-2026-15637 Malicious code in test__123q1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6 The package declares a postinstall hook node dist/script.js while its declared main entry dist/index.js is an inert 105-byte stub, so the entire...

Malicious code in evilpostinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...

MAL-2026-15625 Malicious code in evilpostinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...

Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

MAL-2026-15565 Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

Malicious code in common-array-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8dc846e743e9517d8444feb25299ce05d9c6e060a050fdaa1b3b44a8cb5cbd package.json declares scripts.postinstall = 'node index.js'. On npm install, index.js reconstructs a URL from a String.fromCharCode numeric array...

MAL-2026-15550 Malicious code in common-array-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8dc846e743e9517d8444feb25299ce05d9c6e060a050fdaa1b3b44a8cb5cbd package.json declares scripts.postinstall = 'node index.js'. On npm install, index.js reconstructs a URL from a String.fromCharCode numeric array...

MAL-2026-15559 Malicious code in secretkey2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook node lib/core.js that runs a Windows...

Malicious code in secretkey2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook node lib/core.js that runs a Windows...

MAL-2026-15551 Malicious code in date-fns-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967 package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to...

Malicious code in date-fns-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967 package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to...

Malicious code in vitest-chalk-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running...

MAL-2026-15563 Malicious code in vitest-chalk-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running...

MAL-2026-15562 Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

Malicious code in 2fasecretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...