Malicious code in @kite-js-tools/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9 package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall hook performs an HTTPS GET ...

Malicious code in hyper-kube-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e6e8d8500ee41d92250882b57d98d805b381d2d08eeeac7bae55c3f5e417dff package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in content-publisher-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3faac0139a1c2fd25d8b955e9290380bec365a1d3034fb793dfa723cb930463 package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance os.hostname, os.userInfo, homedir,...

Malicious code in vscode-designer-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf384e12e957c8d6b3d0014504f652cd2b6f3885f49820a2907865566bb6137 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in github-app-sts-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9434f2e4ac17da4d2b9dff0c36ed8b3c5cc3f76882b9898b768e78ba982bbac2 The package declares a preinstall lifecycle hook that runs index.js on npm install. index.js collects host identifiers and system files os.hostname,...

Malicious code in test22221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53 package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTT...

Malicious code in tracker-radar-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1 package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, D...

Malicious code in warp-drive-internal-tooling (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a62165101225b7ad5371e9310e013a9e1dc69b59a475a7a4ccd7cdf0d7996c1d [email protected] declares a preinstall hook that runs index.js, which on Windows spawns a hidden-window PowerShell process powershe...

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...

Malicious code in umadev (npm)

npm/umadev is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the worm...

MAL-2026-11956 Malicious code in @umacloud/cli-linux-musl-arm64 (npm)

npm/@umacloud/cli-linux-musl-arm64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11955 Malicious code in @umacloud/cli-linux-arm64 (npm)

npm/@umacloud/cli-linux-arm64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @qlik/dts-bundler (npm)

npm/@qlik/dts-bundler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in @adminide-stack/clock-tik-browser (npm)

npm/@adminide-stack/clock-tik-browser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

Malicious code in @umacloud/cli-linux-x64 (npm)

npm/@umacloud/cli-linux-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11954 Malicious code in @umacloud/cli-darwin-x64 (npm)

npm/@umacloud/cli-darwin-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11791 Malicious code in @qlik/embed-svelte (npm)

npm/@qlik/embed-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @umacloud/cli-darwin-x64 (npm)

npm/@umacloud/cli-darwin-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @umacloud/knowledge (npm)

npm/@umacloud/knowledge is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11957 Malicious code in @umacloud/cli-linux-musl-x64 (npm)

npm/@umacloud/cli-linux-musl-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...