Malicious code in checkmate-remediation-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f55d0ebeea19e228ec6edbb1782df87539c476478d3935559fda90a458b1b4 The package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, the home...

MAL-2026-17500 Malicious code in @nagular/router (npm)

@nagular/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

MAL-2026-17492 Malicious code in @angularr/cli (npm)

@angularr/[email protected] impersonates @angular/cli it copies the code and metadata of @angular/cli, including the ng binary and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

Malicious code in express-fork (npm)

[email protected] impersonates express it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

MAL-2026-17242 Malicious code in express-javascript (npm)

The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17248 Malicious code in xeprews (npm)

The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in express-nodejs (npm)

The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-16370 Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

Malicious code in @uh-platform/webcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...

MAL-2026-16362 Malicious code in @uh-platform/webcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...

MAL-2026-16361 Malicious code in @uh-platform/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c35cffdc174427ac57ea3c5e8ac02ec41159f8f25ffe1ef152e0437e5e533458 The package's package.json declares a preinstall lifecycle hook that runs node index.js. index.js invokes childprocess.exec on a curl command whose U...

Malicious code in @uh-platform/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c35cffdc174427ac57ea3c5e8ac02ec41159f8f25ffe1ef152e0437e5e533458 The package's package.json declares a preinstall lifecycle hook that runs node index.js. index.js invokes childprocess.exec on a curl command whose U...

MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

MAL-2026-16118 Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

MAL-2026-16071 Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

MAL-2026-15561 Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

MAL-2026-15564 Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...