916 matches found
Malicious code in antsrcsrctest (npm)
The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....
Malicious code in @web3-helpers/core (npm)
Source: amazon-inspector 9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225 At npm install time the preinstall script dist/index.min.js reads installer-owned secrets — /.ssh/idrsa, /.env, /.env.local, /.wallet.json — and iterates process.env for keys matching PRIVATE, MNEMONIC, and...
Malicious code in ac-raf-emitter (npm)
Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL https://webhook.site/54919426-084d-4288-8f80-e36ae5c76e32, passing the installer's...
Malicious code in ls-env-config (npm)
Source: amazon-inspector db44619df34ccbffa5747f17c8135602583a781ec01f8d3c03e0f828157e944c Package declares a preinstall script node./index.js that fires automatically on npm install. The executed index.js issues an HTTP GET to a Burp-Collaborator-style subdomain at...
Malicious code in @debile/require-dir (npm)
Source: amazon-inspector 3075732c05c8b941b57fed9e8fe9c788b28f9ff6fe9ef91936d1802f568c594e Package @debile/require-dir republishes the code of the well-known require-dir package under a different scope. Its package.json preinstall script runs bash -c 'if 1 == 2 ; then curl...
Malicious code in infrastructure-common (npm)
Source: amazon-inspector d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578 package.json declares a preinstall lifecycle script that runs node -e to issue an HTTP GET to a Burp Collaborator subdomain at w635fyvrqkfmh9wc9uw8444cp3vujl7a.oastify.com when npm install runs. The callback...
Malicious code in hyperpure (npm)
Source: amazon-inspector 96c5552a039e4d845c30fae8f2c376eed21309d6b5298193850594fe4b1854d0 On npm install, the preinstall lifecycle script in package.json runs curl to POST the installer's hostname hostname -f, current user whoami, working directory pwd, and a base64-encoded dump of the entire...
Malicious code in library-explorer (npm)
Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch, os.homedir, os.userInfo username/uid/gid/shell, CPU/memory and...
Malicious code in crosswalker (npm)
Source: amazon-inspector b352c9c53fc71d511dae5d0fd8acc4462286092822d70e37dd413593f12bf0d3 package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects hostname, platform, arch, homedir, username, uid/gid, shell, OS info, cwd, and the...
Malicious code in api-changelly (npm)
Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname, os.platform, os.arch, os.userInfo username/uid/gid/shell, home...
Malicious code in 0vulns-dependency-confusion-poc (npm)
The package communicates with a domain associated with malicious activity. Source: amazon-inspector 3d282025fb2ec1b4012e3b979cec1f66520e643fcadfd2864e54989de50dd00d The package.json preinstall script runs wget against an attacker-controlled webhook.site URL, passing $whoami, $pwd, and $hostname a...
MAL-2026-10734 Malicious code in infrastructure-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578 package.json declares a preinstall lifecycle script that runs node -e to issue an HTTP GET to a Burp Collaborator subdomain at...
Malicious code in infrastructure-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578 package.json declares a preinstall lifecycle script that runs node -e to issue an HTTP GET to a Burp Collaborator subdomain at...
MAL-2026-10678 Malicious code in ls-env-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db44619df34ccbffa5747f17c8135602583a781ec01f8d3c03e0f828157e944c Package declares a preinstall script node./index.js that fires automatically on npm install. The executed index.js issues an HTTP GET to a...
Malicious code in ls-env-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db44619df34ccbffa5747f17c8135602583a781ec01f8d3c03e0f828157e944c Package declares a preinstall script node./index.js that fires automatically on npm install. The executed index.js issues an HTTP GET to a...
Malicious code in ac-raf-emitter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL...
MAL-2026-10675 Malicious code in ac-raf-emitter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL...
Malicious code in @debile/require-dir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3075732c05c8b941b57fed9e8fe9c788b28f9ff6fe9ef91936d1802f568c594e Package @debile/require-dir republishes the code of the well-known require-dir package under a different scope. Its package.json preinstall script ru...
MAL-2026-10634 Malicious code in estore-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...
Malicious code in estore-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...