Malicious code in @checkrhq/adjudication-api-client (npm)

Source: amazon-inspector 8c52d9987ace09f0c48d8b0661bd1fcd3cf4e7e701b5e515810c7f32d99086cf package.json declares a preinstall lifecycle script that runs curl to POST installer reconnaissance data — hostname, current user whoami, working directory, and uid/gid id — to a hardcoded webhook.site...

Malicious code in ledgerflow-deploy-utils (npm)

Source: amazon-inspector 5f0097d19be676ac30ff79dffcff38f128873c80115a8a150c3eceff0422aa93 On npm install, the package's postinstall script queries the AWS instance metadata service IMDSv1 at 169.254.169.254 for the attached IAM role and POSTs the result, along with an IMDS-reachability probe, ove...

Malicious code in rtc-integration-frontend-sdk (npm)

Source: amazon-inspector acfd49527fb8be1135feb424b68f6c46779ba146d8372d276eac1735770d6e5a [email protected] registers a postinstall lifecycle hook "postinstall": "node index.js" that fires automatically on npm install. index.js collects installer host reconnaissance — os.hostnam...

Malicious code in nonenull1 (npm)

Source: amazon-inspector 162cd9e0496d35e0500fe084f6011a3e6893182b0fa209502c5d6017ab1138ac The package declares gypfile: true with no native C/C++ sources, and its binding.gyp abuses GYP command-expansion syntax in the sources list — !node index.js... with type: none — so that npm's automatic...

Malicious code in @meziizana/frontend-logger (npm)

Source: amazon-inspector a7d77255cb713e19b9560cc339e937518fdbfb49ab048d9d5a65ad81c1309a9a package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/f164a383-b9e7-4379-b18c-38bf41a3c152/ with query parameters carrying the installer's username $whoami, current...

Malicious code in client-cookies-agent (npm)

Source: amazon-inspector 12870ae203f2612ab2bf9e796583acba17914cd4699909156f86c643fcf51f24 package.json declares postinstall=node index.js, which runs automatically on npm install. index.js collects host identifiers via os.hostname, os.userInfo, and process.cwd, resolves the external IPv4 address,...

Malicious code in giantswarm (npm)

Source: amazon-inspector 75f3a244f2761c56347f695897a491d23ab04cafe1e5b0e46fd7d0d2c993f828 The package declares a preinstall hook node index.js that runs automatically on npm install. index.js collects host reconnaissance — hostname, platform, arch, home directory, username/uid/gid/shell, whoami,...

Malicious code in react-dom-v17 (npm)

Source: amazon-inspector f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29 Package name impersonates the widely-used react-dom package react-dom-v17. package.json declares preinstall: node index.js, which fires automatically on npm install. The preinstall script index.js shells out...

Malicious code in cbr-internal-utils (npm)

Source: amazon-inspector fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7 On module load, the package's main entrypoint shells out via childprocess.exec to run cat /etc/passwd and prints the contents to stdout. This fires unconditionally when any consumer requires the package — no...

Malicious code in bimi-maker (npm)

Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo, os.platform, homedir, cwd, and related host identifiers...

Malicious code in cheeriobox (npm)

Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which enumerates roughly 60 credential-shaped environment variables...

Malicious code in cppt-common (npm)

Source: amazon-inspector 484688d5963a9246f4fe7a2b5c1c7ebe6bba135a2a5df66b3ab57f44978407b2 [email protected] declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js collects host and user identifiers — os.hostname, os.userInfo, the output of whoam...

Malicious code in utils-style-engine (npm)

Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell, homedir, process.platform, cwd, and the output of...

Malicious code in estore-client (npm)

Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the installer's OS username $whoami, current working directory...

Malicious code in leviosa86-test (npm)

Source: amazon-inspector 46b0bed6337ffe527af2615fed8ae1ecbb449f6a6cb00afa6381f7811ec88956 [email protected] ships src/poc/index.js which uses childprocess.exec to run a shell pipeline that collects host reconnaissance data hostname, current working directory, whoami, a package identifier and...

Malicious code in smb-portal-uikit (npm)

Source: amazon-inspector 395b88ae26544dcfdfca9d46294e1f0558c2e5bade88bac0eb0797d1140debbe Package [email protected] declares a preinstall lifecycle hook that runs node index.js. On npm install, index.js invokes childprocess.exec on whoami and id, reads os.hostname, os.userInfo,...

Malicious code in smb-common-uikit (npm)

Source: amazon-inspector 66072ca2fc20c19a01d0a2b888d90632a7d9bfdc34a2d1a71b61ad06975eae5c package.json declares a preinstall hook that runs index.js. On npm install, index.js collects host reconnaissance from the installer os.hostname, os.userInfo, os.platform, os.arch, homedir, uid/gid, shell,...

Malicious code in patchwork-os (npm)

Source: amazon-inspector 101e7bafc335a4ccaf6418355dc242911c639482ce71a8b1f22b75bbdbb8af7e The package's Gemini driver at dist/drivers/gemini/index.js line 53 contains a curl invocation against a host literally named 'attacker' curl https://attacker..., reached from an install/setup code path...

Malicious code in formatters.ts (npm)

Source: amazon-inspector 21827129edc8dbde114c615df656d5a234d1fbcfa5b9f63d5286d781253e8f2b The package declares a preinstall hook that runs index.js on npm install. index.js collects host and identity reconnaissance — os.hostname, os.platform, os.arch, os.homedir, os.userInfo username, uid, gid,...

Malicious code in date-utils-light (npm)

Source: amazon-inspector 99bd644fd9a59518d6f77e8d76c077ffef8a2afdc7ae2b00a6ca87299879a671 Package presents itself as a trivial date-formatting utility index.js exports a one-line ISO date helper but ships a postinstall.js that runs automatically on npm install. The script shells out via...