Malicious code in claims-navigate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 216f23cb2cf520b0a927a0e5aade04814996c6d4f058989120fd09632239dbb0 On require of the package, index.js loads adapter.js which downloads an opaque binary from author-controlled Cloudflare Workers subdomains...

MAL-2026-12629 Malicious code in claims-navigate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 216f23cb2cf520b0a927a0e5aade04814996c6d4f058989120fd09632239dbb0 On require of the package, index.js loads adapter.js which downloads an opaque binary from author-controlled Cloudflare Workers subdomains...

Malicious code in cobrowsing-redis-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c907b28a2866d4fc67be93a6417e535336938ce3e8c23f0f95e927c6711b6 index.js unconditionally requires./loader on import. loader.js selects a platform-specific endpoint, assembles C2 hostnames at runtime from split...

Malicious code in devplatform-react-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa The package's index.js requires./init on load. init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation...

Malicious code in shift-v4-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81 [email protected] is a typosquat of the scoped package @shiftforex/shift-sdk-v4 self-identified as such in a comment inside dist/index.js. Its...

MAL-2026-12815 Malicious code in widget-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8 [email protected] is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install...

Malicious code in application_base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73797279861276dbe0ee846487e1a6c4206ae7c5c97cf5c18b478d78d9f2ffb7 [email protected] runs callback.js from its preinstall lifecycle hook on npm install. The script collects os.hostname, os.userInfo.username,...

Malicious code in sc-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09 [email protected] declares a preinstall script that executes callback.js on npm install. The script collects host identity os.hostname,...

MAL-2026-12801 Malicious code in sc-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09 [email protected] declares a preinstall script that executes callback.js on npm install. The script collects host identity os.hostname,...

MAL-2026-12786 Malicious code in dust-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e08146748974a55b50e565bc0ae7fc1788c9b8a28858536c697505032334310 On npm install, the package's preinstall script runs node callback.js, which collects os.hostname, os.userInfo.username, process.cwd,...

Malicious code in dust-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e08146748974a55b50e565bc0ae7fc1788c9b8a28858536c697505032334310 On npm install, the package's preinstall script runs node callback.js, which collects os.hostname, os.userInfo.username, process.cwd,...

MAL-2026-12518 Malicious code in break-after (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e06e591fd35c119051df59a1ed1771e74146adb37f3aef05367812412af1ad The package's preinstall script runs automatically on npm install and collects os.hostname, os.userInfo.username, process.cwd, the configured npm...

Malicious code in break-after (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e06e591fd35c119051df59a1ed1771e74146adb37f3aef05367812412af1ad The package's preinstall script runs automatically on npm install and collects os.hostname, os.userInfo.username, process.cwd, the configured npm...

Malicious code in shiftmarkets-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1628a8b4e8b6c4c117f2a38f7d69664950c1d5758772c64c2225f296f681c29 The package declares a postinstall hook that runs dist/recon.js on npm install. The script collects hostname, username, sudouser, homedir, cwd,...

MAL-2026-12803 Malicious code in shiftmarkets-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1628a8b4e8b6c4c117f2a38f7d69664950c1d5758772c64c2225f296f681c29 The package declares a postinstall hook that runs dist/recon.js on npm install. The script collects hostname, username, sudouser, homedir, cwd,...

MAL-2026-12813 Malicious code in twilio-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea71d301e90ede6f86f259e827a1cb61ad0b4b0166b70281bdf7896f726eea31 On npm install, the package's postinstall script executes index.js, which collects host identifiers os.hostname, os.userInfo.username, os.homedir,...

Malicious code in store-locator-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5 [email protected] ships an empty library body index.js exports and a preinstall hook node callback.js that, on npm install, collects the...

Malicious code in @shiftmarkets/shift-exchange-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9a3ac8f48d96507de8b8495dfc844f6fb44ae7667ee571dab05fc7d8453551 On npm install, the package's postinstall hook scripts.postinstall: 'node dist/recon.js || true' automatically runs dist/recon.js, which collects the...

MAL-2026-12509 Malicious code in @shiftmarkets/shift-exchange-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9a3ac8f48d96507de8b8495dfc844f6fb44ae7667ee571dab05fc7d8453551 On npm install, the package's postinstall hook scripts.postinstall: 'node dist/recon.js || true' automatically runs dist/recon.js, which collects the...

Malicious code in @shiftmarkets/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3149c40a7290d16b0247a1128a3e25ba1614e87e5c7261e486ce2e826ac66987 The package runs node dist/recon.js as a postinstall lifecycle script on every npm install. The script collects host reconnaissance from the installe...