Malicious code in babyyodaa (npm)

Runs on install. The preinstall script marks a shell script bundled in the package as executable and runs it; the script contains a reverse-shell pattern, giving a remote party a shell on the installing machine. Version examined: 1.1.0; tarball SHA-256...

Malicious code in @signals-notebook/annotation-editor (npm)

Runs on install. The preinstall script sends the output of id the installing user's identity and groups, base64-encoded, to a request-bin host with curl. This is the dependency-confusion probe pattern; it leaks data from every machine that installs the package. Version examined: 2.2.60-630109c;...

Malicious code in @atfm/utils (npm)

@atfm/[email protected] is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The script...

Malicious code in @atfm/atfm-material-ui (npm)

@atfm/[email protected] is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The scrip...

Malicious code in service-roles-registry (npm)

Source: amazon-inspector 4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0 [email protected] runs index.js as a preinstall script. On npm install, index.js reads os.hostname, os.userInfo.user, process.cwd, and package metadata and POSTs them over HTTPS to the hardcoded...

Malicious code in service-roles-registry (npm)

service-roles-registry runs code during npm install that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint: - 99.0.2 published 2026-11-02 17:53 UTC: its preinstall script is node index.js, which npm runs during npm...

MAL-2026-18519 Malicious code in service-roles-registry (npm)

service-roles-registry runs code during npm install that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint: - 99.0.2 published 2026-11-02 17:53 UTC: its preinstall script is node index.js, which npm runs during npm...

Malicious code in claims-ac1 (npm)

claims-ac1 1.0.0 contains only a package.json declaring a single dependency, node-ac2, that is not fetched from the npm registry but from a tarball in the GitHub repository GamerD11/pingtest https://github.com/GamerD11/pingtest/raw/main/node-ac2.tgz. That tarball has no code and in turn depends o...

Malicious code in @mobile-platform/magnetic-components (npm)

@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves @mobile-platform from npm runs its code instead of...

Malicious code in bigbob22-test (npm)

[email protected] has no functional code and an empty README. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in cutekitten-test (npm)

[email protected] describes itself as a security test package for a school project and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in axelarjs-sdk (npm)

[email protected] takes the unscoped name of @axelar-network/axelarjs-sdk and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in calculator-preinstall-hook-demo (npm)

[email protected] presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook...

Malicious code in wallet-adapter-base (npm)

wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in calculator-preinstall-chain-demo (npm)

[email protected] has no install script of its own but depends on exactly [email protected], so npm install runs that package's preinstall script node preinstall.js. The script POSTs the machine's hostname and the OS username to the Discord webhook...

MAL-2026-18502 Malicious code in @goparrot-dashboard/homepages (npm)

@goparrot-dashboard/homepages is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/marketing (npm)

@goparrot-dashboard/marketing is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

MAL-2026-18507 Malicious code in @goparrot-dashboard/order (npm)

@goparrot-dashboard/order is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

MAL-2026-18511 Malicious code in @goparrot-dashboard/store (npm)

@goparrot-dashboard/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @goparrot-dashboard/store (npm)

@goparrot-dashboard/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...