Malicious code in @pelmnaads/naads-common-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68990dfacdc750bf464d646aca4855c2dd23bbefcadef1d9638e2d663a23fc57 The package is published to the public npm registry under @pelmnaads/naads-common-logger with version 19999.0.1 — the canonical dependency-confusion...

MAL-2026-3749 Malicious code in @webapp-next/store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbad3803cdda40845fe2aa64e0963b9293f9ee523b3f9205a354da2ae1e317bf package.json declares "preinstall": "node index.js", which runs automatically on npm install. index.js collects os.hostname, os.platform, os.arch,...

MAL-2026-3771 Malicious code in request-logger-canary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0d566d7abb400988aea74b00099a6db4c5ea928f32e7d44648193e21a36035 [email protected] ships a preinstall.js that, when npm install runs, opens a TCP socket to 52.74.242.200:8851 and pipes an interactive...

Malicious code in prisma-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aab2820bfb9036995418ba2b36887f8970d7deaa69d8bc4aa24e36266bf18d1 [email protected] is a name-confusion package against the genuine prisma ORM. Its package.json declares "preinstall":...

WS-2020-0176

Upon installation, the 'electorn' package runs a preinstall script that writes a public comment on GitHub containing the following information: IP, IP-based geolocation, home directory name and local username...

WS-2020-0175

Upon installation, the 'loadyaml' package runs a preinstall script that writes a public comment on GitHub containing the following information: IP, IP-based geolocation, home directory name and local username...

WS-2019-0488

Yeoman-genrator v1.0.0 contains malicious code as a preinstall script. The package is malware designed to take advantage of user's mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0482

All versions of uglyfi.js contains malicious code as a preinstall script. The package designed to take advantage of user's mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0481

All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking...

WS-2019-0444

Version 1.0.0 of logsymbles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0443

Version 1.0.0 of log-symboles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0436

All versions of jquerz contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0429

All versions of froever contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor...

WS-2020-0061

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM...

WS-2019-0411

colro-name contains a malicious code as a preinstall script. The package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0410

colour-string contains a malicious code as a preinstall script. The package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0380

8.9.4 is a malicious package which runs a dangerous code as a preinstall script and reads the system's SSH keys but does not upload it to a remote server...

MAL-2026-3684 Malicious code in @gusmano/reext (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 498a21b60dcdfe236ea0b1683e1ec64aa091643b6ad562c3845757eed79660d8 The npm preinstall lifecycle script dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/preinstall.js" reads the...

MAL-2026-3644 Malicious code in camelotlabs-worker (npm)

Five packages camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry at version 99.0.0 by the actor madman0619 as a dependency confusion attack targeting the internal npm packages of Camelot Labs. The inflated...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload. A malicious actor compromised the package, enabling the attacker to publish tampered versions of the deep learning framework. Malicious Behavior The execution chain ru...