Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)

Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to http://127.0.0.1:8099/ carrying those identifiers along with t...

Malicious code in @rutxploit-sec/waves-button-poc (npm)

Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall script that runs node -e code which reads os.hostname and...

MAL-2026-17289 Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to...

Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to...

Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

MAL-2026-17290 Malicious code in @rutxploit-sec/waves-button-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...

MAL-2026-17266 Malicious code in @hrmony/kit-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5 The package's preinstall script and its main entry index.js both perform identical credential-harvesting: they query the EC2 Instance Metadata Servic...

Malicious code in exptred (npm)

Source: amazon-inspector d91842ab3e5c93f5689a985b63f8de5455910d88d6815ee35f2d35d27f8a4cf7 npm package [email protected] is a typosquat of express: package.json copies express's description 'Fast, unopinionated, minimalist web framework', author TJ Holowaychuk, repository expressjs/express, and homepa...

Malicious code in exprrdd (npm)

Source: amazon-inspector bc1c956097cd13e80298a796a5026ebd91ece7c2ad53d226d3729f0b0b0ee9f3 Package 'exprrdd' copies express's metadata name-lookalike, description, author, contributors, repository, keywords, dependencies as cover for a preinstall dropper. package.json line 98 declares a preinstall...

Malicious code in exprrdd (npm)

The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17244 Malicious code in exprrdd (npm)

The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17246 Malicious code in exptred (npm)

The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in llm-nebula (npm)

Source: amazon-inspector 0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669 Package presents itself as an LLM SDK nebula.js exposes a small client stub but declares preinstall: node preinstall.cjs in package.json, and preinstall.cjs is a 232KB single-line obfuscated blob that runs...

Malicious code in nebula-llm (npm)

Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed string literal. On npm install on Windows, the script...

Malicious code in nebula-llm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...

MAL-2026-17227 Malicious code in nebula-llm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...

Malicious code in eslint-plugin-skywagon-web (npm)

Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects installer-side identifiers — os.hostname, os.userInfo.username,...

Malicious code in eslint-plugin-skywagon-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...

MAL-2026-17215 Malicious code in eslint-plugin-skywagon-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...

MAL-2026-16480 Malicious code in a-onesite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...