Malicious code in @ch4acko3/frontal-lobe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b73f6f94b2fcc3ef2aabd490862d743e9722f891d2c41421b1352dc318294585 The package hardcodes the endpoint http://47.112.15.137:8789/frontal/trace-sync bare IPv4, plain HTTP in...

Malicious code in stretchshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60 package.json declares a postinstall hook that runs node demo/demo.js base, which shell-invokes git clone...

MAL-2026-13460 Malicious code in stretchshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60 package.json declares a postinstall hook that runs node demo/demo.js base, which shell-invokes git clone...

Malicious code in @innocarpe/deepseek-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecff1188eb08eef1faffb2e898fe393c3311abdf5e96f041435a5ca12163dc67 The npm package's postinstall script scripts/postinstall.js requires childprocess and issues POST requests carrying environment and host identifier...

MAL-2026-13420 Malicious code in @innocarpe/deepseek-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecff1188eb08eef1faffb2e898fe393c3311abdf5e96f041435a5ca12163dc67 The npm package's postinstall script scripts/postinstall.js requires childprocess and issues POST requests carrying environment and host identifier...

MAL-2026-13423 Malicious code in fetchrtds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e0a6afc9e0684beee9d75d2f4966507178bed2499c8f5453629a0b827a80ef On npm install, the package's postinstall script reads a config URL defaulting to https://slimopump.vercel.app/config/clob-math.json, fetches a.tgz...

MAL-2026-13405 Malicious code in vitest-preview-pro-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...

Malicious code in helmet-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402 [email protected] is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawn...

MAL-2026-13401 Malicious code in helmet-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402 [email protected] is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawn...

MAL-2026-13377 Malicious code in ezdiscordbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a715452291e1bd779802f51dc90eca91740307e0bee7b9e2ca94f6f863f6a921 package.json declares a postinstall script sudo node install.js that runs install.js with root privileges on the installer's machine. Both install.js...

Malicious code in ezdiscordbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a715452291e1bd779802f51dc90eca91740307e0bee7b9e2ca94f6f863f6a921 package.json declares a postinstall script sudo node install.js that runs install.js with root privileges on the installer's machine. Both install.js...

Malicious code in npm-dc-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723 package.json declares "postinstall": "node test.js". test.js top-level require'.'s index.js and awaits an exported fromstr. index.js consists of a...

MAL-2026-13378 Malicious code in npm-dc-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723 package.json declares "postinstall": "node test.js". test.js top-level require'.'s index.js and awaits an exported fromstr. index.js consists of a...

Malicious code in app-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2be81204ed300a759662ca3315431eec9dbb11392232f04cc58d1a815fb94b4 On npm install, scripts.postinstall executes test.js, which performs three attacker-beneficial actions against the installer's host. First, it...

MAL-2026-13368 Malicious code in express-dever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31 [email protected] registers postinstall: node index.js in package.json, and index.js is heavily obfuscated obfuscator.io-style rotated string array...

Malicious code in express-dever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31 [email protected] registers postinstall: node index.js in package.json, and index.js is heavily obfuscated obfuscator.io-style rotated string array...

MAL-2026-13366 Malicious code in @workoscalif/sudoku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217 package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a 34 kB static...

Malicious code in app-kst-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08cfc426d2f4b29bba2b81f2eb56eeee32ab114338a51fae5eeced2571e6b2d9 On npm install, package.json's postinstall runs node test.js, which triggers three malicious paths against the installer. 1 A recursive scan of the...

Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

MAL-2026-13357 Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...