Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

MAL-2026-14167 Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

MAL-2026-14168 Malicious code in chalk-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4 [email protected] is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm...

Malicious code in chalk-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4 [email protected] is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm...

Malicious code in lodash-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm...

MAL-2026-14182 Malicious code in lodash-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm...

Malicious code in chalk-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf1ccbcd9b3ae6643a7948154a981ef7e072afbae6d9611f832df11fccc6707 [email protected] typosquats the popular chalk package but ships no chalk functionality — index.js exports an empty object. Its only behavior is in...

MAL-2026-14165 Malicious code in chalk-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf1ccbcd9b3ae6643a7948154a981ef7e072afbae6d9611f832df11fccc6707 [email protected] typosquats the popular chalk package but ships no chalk functionality — index.js exports an empty object. Its only behavior is in...

Malicious code in chalk-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js. On install the script XOR-decodes...

MAL-2026-14166 Malicious code in chalk-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js. On install the script XOR-decodes...

Malicious code in commandor-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab The postinstall script in [email protected] scripts/postinstall.js contains XOR-obfuscated byte arrays that decode at runtime unpackSegment with k...

MAL-2026-14173 Malicious code in commandor-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab The postinstall script in [email protected] scripts/postinstall.js contains XOR-obfuscated byte arrays that decode at runtime unpackSegment with k...

Malicious code in @evial/runtime-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59022bd399abaafea3b730e96ba9cc0252dbf18266f6f14200e0b1b6f1feba6f The package's package.json declares postinstall: node -e "require'./scripts/lodash.js'" and sets the same file as main, so the payload runs both on n...

MAL-2026-14159 Malicious code in @evial/runtime-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59022bd399abaafea3b730e96ba9cc0252dbf18266f6f14200e0b1b6f1feba6f The package's package.json declares postinstall: node -e "require'./scripts/lodash.js'" and sets the same file as main, so the payload runs both on n...

MAL-2026-14172 Malicious code in commandor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75d139bce34f1d3290c34bb6da1c421bb579afb93672b44909ed0725eb70be3c The postinstall script in [email protected] scripts/postinstall.js XOR-decodes a hardcoded URL using key 'stf2026' that resolves to...

Malicious code in commandor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75d139bce34f1d3290c34bb6da1c421bb579afb93672b44909ed0725eb70be3c The postinstall script in [email protected] scripts/postinstall.js XOR-decodes a hardcoded URL using key 'stf2026' that resolves to...

Malicious code in comander-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19734d8bfb929b0c1049b6220271fabaa91603506cdcb6424e67988519da9a6e [email protected] is a typosquat of commander with an empty index.js and no native sources. Its scripts/postinstall.js runs automatically on npm...

Malicious code in dev-env-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...

MAL-2026-14176 Malicious code in dev-env-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...