Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

Malicious code in test_payload_folder (npm)

Source: amazon-inspector 866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf The package exposes a startVoiceJoinerconfig API that accepts a caller-supplied Discord USERTOKEN and optional USERTOKEN2 ostensibly for gateway login. Before using the tokens for their advertised purpose, t...

MAL-2026-13470 Malicious code in ynastore-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5636385d60c311b2159f6aed3cf5d9d66abb6cb5af562d432920c63944759f30 ynastore-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 and 436 reconstruct a network destination via...

Malicious code in shiroai (npm)

Source: amazon-inspector 8cde2f64fd59e62071433f92eab83a4817f0b306ff1735aa8c31ae31dcaf9830 shiroai is advertised as a CLI where the installer authenticates with their own API key via shiroai login . In practice, cli.js ignores any user-supplied key and sends every chat request to...

Malicious code in seedcode-facturacion-electronica (npm)

Source: amazon-inspector 366dad27b664f3be411dc07609ee2f6f6b73a3cbc179d7c0105f20ce8bc77d3e The package advertises itself as a client for submitting El Salvador electronic invoices DTEs directly to the Ministerio de Hacienda. In practice, the exported sendtomh and sendinvalidationtomh functions...

Malicious code in qazaq-cli (npm)

Source: amazon-inspector 31fa15731b4c683297d550bb3157dff08f2bfa3db01c14952cd35c7c61407d0a The package's default AI provider hardcodes the destination opengateway.gitlawb.com/v1/chat/completions with header api-key: 'not-needed' src/providers/gateway.js:3-4. The default value of QAZAQPROVIDER is...

Malicious code in n8n-nodes-whatsapp-business-api-by-automations-builder (npm)

Source: amazon-inspector a012be4fda5d6832fa3f4b404fd0026c0b351642260408e7f4fbb955e48b38a8 Package presents itself as an n8n node for the WhatsApp Business API Meta Graph. Instead of calling graph.facebook.com, every request — credential validation, sendMessage, fetchMessageTemplates — is routed t...

Malicious code in naileys (npm)

Source: amazon-inspector 53307e8df479525765ddef8cf9a54dcf0aa368b8ef57a088b624a5e80f72c999 naileys is a fork/lookalike of the WhatsApp library baileys single-character edit; internal references still mention 'wileys', and fetchLatestBaileysVersion in lib/Utils/generics.js queries...

Malicious code in lhisp-logger (npm)

Source: amazon-inspector a9ba8f52d22e4435a81a1ffe643e4bb25b0e64fff60c585cac35c164e4ccb24f The package is published as a generic logging library but configures a pino-loki transport whose destination defaults to http://logs.lhprovedor.com.br:3100 — a host owned by the author. The default is active...

Malicious code in hiura-baileys (npm)

Source: amazon-inspector 5ebb60061f29d4f4279bca1129ebfccefb928bd22364f26961205935ff71393f This is a fork of the Baileys WhatsApp library that adds undocumented behavior abusing the consumer's authenticated WhatsApp account for the author's benefit. When a consumer creates a socket via the package...

Malicious code in fca-eryxenx (npm)

Source: amazon-inspector 7569b032ce4e06251ebfe06b4fc124689f20ca0a7e14b5b2395dc7295bfa18c6 The package's documented login API — loginemail, password, twofactor — POSTs the caller's Facebook email, password, and 2FA secret to https://minhdong.site/api/v1/facebook/loginios as the hardcoded default...

Malicious code in claude-all-config (npm)

Source: amazon-inspector 63c5a1f5a6f5bd2dadc4e207ff4e8e310c24cd4c99c751ed094251e00e0af8f3 On install, postinstall.js writes configuration into /.claude/, /.gemini/, /.codex/, and /.kiro/ that hard-wires AI tooling to author-controlled destinations: 1. Silent relay to author's Telegram: mcp.json...

Malicious code in chromestaff-baileys (npm)

Source: amazon-inspector 4d5fad12014025f37f607a61051a445262f37bcee6682850dfd77cc0dcb0b486 chromestaff-baileys is a fork of the Baileys WhatsApp library that, on every successful WhatsApp connection, silently forces the connected user's WhatsApp account to follow a hardcoded author-controlled...

Malicious code in carvus-lens (npm)

Source: amazon-inspector be2182b552b0a8359f3314078d48310cfcd57738e1934aacf00ac8775a32cfe0 carvus-lens is a screen-capture/OCR Electron-style tool whose advertised 'Ask AI', 'Translate', and 'Search' features silently route user-selected screen content to two third-party services chosen by the...

Malicious code in @touchvue/chat (npm)

Source: amazon-inspector 0921a05dced95d8d0bb5d99de362f67e4e67832874fb0b4391629f5dfe6e926d The published tarball's chat components AiChat/Chat/useSSE.js and AiChat/ChatInput.vue2.js ship with hardcoded defaults that point the chat backend at https://api.apiyi.com/v1/chat/completions a third-party...

Malicious code in @hanssoft/baileys (npm)

Source: amazon-inspector e3f83fb38a98b69c322df069a26c495101aa35682df8f83641b00e2ce40a99bd This package is a fork of the WhatsApp library Baileys whose metadata homepage, repository, author points at the upstream @whiskeysockets/baileys, while the code is modified. When a consumer calls the...

Malicious code in @exocore/exocode (npm)

Source: amazon-inspector 6b1e32b74c68582be18feb35e92f095c753491a1c6b9e62b52eb0a1dbe300d69 The package ships a CLI binary dist/exocore that hardcodes process.env.ANTHROPICBASEURL to https://exocoreai-exocore-gateway.hf.space/v1 and process.env.ANTHROPICAPIKEY to 'exocode-key' as defaults when thos...

Malicious code in @dekuzxc/nexca (npm)

Source: amazon-inspector 35a4db02ce3d3ea022c8a6b5349975b4721d3f2c5b516b6c3dd3dddbfa802271 When a consumer uses the advertised api.listen/listenE2EE flow, every incoming message attachment of type "photo" is auto-uploaded to imgbb.com using a hardcoded API key. In src/listenMqtt.js lines 64-69,...

Malicious code in @flowselections/core (npm)

Source: amazon-inspector b28cf238827c035b4f3103aff9bf803421b7d16d1c7877d7e74c5fcd71f3283b The package exports a supabase client and LoginPage component wired to a hardcoded Supabase URL https://vmicscahrnzpmhagztmx.supabase.co and anon key with no env-var or prop override. In...

Malicious code in @budetzzgantenk/baileys (npm)

Source: amazon-inspector 81b1fbb4415cf2858924d511ef2bf96ad5152dda4537a264f45d1b4d847ba25d Package @budetzzgantenk/baileys is a modified fork of @whiskeysockets/baileys that adopts the upstream's homepage https://github.com/whiskeysockets/baileys and author name Adhiraj Singh in package.json while...