MAL-2026-12031 Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

MAL-2026-12030 Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

MAL-2026-11998 Malicious code in simple-date-formatter-util-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693 Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script...

Malicious code in @zzzgenesis00/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...

MAL-2026-11530 Malicious code in @zzzgenesis00/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc49c7ec56350694f458d9468efb51a30a9ac20ff490ac44b0cedd8bbbe004a5 The package is published as @zzzgenesis00/etherjs with author 'ricmoo' and a description mimicking the legitimate ethers.js library. On npm install,...

Malicious code in @zzzgenesis00/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3 postinstall.js runs automatically on npm install and enumerates installer-owned secret material: SSH private keys under /.ssh, /.npmrc, /.gitconfig,...

MAL-2026-11529 Malicious code in @zzzgenesis00/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3 postinstall.js runs automatically on npm install and enumerates installer-owned secret material: SSH private keys under /.ssh, /.npmrc, /.gitconfig,...

Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

MAL-2026-11533 Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

Malicious code in @zzzgenesis00/solana-wallet-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46 The postinstall.js script, which runs automatically on npm install, harvests a broad set of installer-owned secrets and identity data and exfiltrates...

MAL-2026-11532 Malicious code in @zzzgenesis00/solana-wallet-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46 The postinstall.js script, which runs automatically on npm install, harvests a broad set of installer-owned secrets and identity data and exfiltrates...

MAL-2026-11539 Malicious code in entropyeasybots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111,...

Malicious code in @zzzgenesis00/hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9f452c698c4accd69ca2df75854aae3189ecf3dddafc4b62d86403ca3d911f On npm install, scripts.postinstall executes postinstall.js which harvests installer-side secrets and host reconnaissance and transmits them to...

MAL-2026-11531 Malicious code in @zzzgenesis00/hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9f452c698c4accd69ca2df75854aae3189ecf3dddafc4b62d86403ca3d911f On npm install, scripts.postinstall executes postinstall.js which harvests installer-side secrets and host reconnaissance and transmits them to...

MAL-2026-11534 Malicious code in @zzzgenesis00/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ad59aa1c004d723d6e24f8113d8f3d45728c0b26fc41531ec00c0f91d2ddef The package impersonates XRPLF's xrp-lib author metadata and homepage point at github.com/XRPLF/xrp-lib while being published under an unrelated scop...

MAL-2026-11546 Malicious code in simple-date-formatter-util-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c4633742f36d29ca968a2ce71c97cb81e9cb2d2c76738742bb39de671cb115 Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launches a backgrounded interactiv...

Malicious code in simple-date-formatter-util-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c4633742f36d29ca968a2ce71c97cb81e9cb2d2c76738742bb39de671cb115 Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launches a backgrounded interactiv...

Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...

MAL-2026-11544 Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...