Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

Malicious code in comand (npm)

Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux, with WSL detection to a hardcoded bare-IP endpoint at...

Malicious code in axious-core (npm)

Source: amazon-inspector da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25 axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte arrays are XOR-decoded at runtime with the key 'stf2026' to...

Malicious code in testingsmthb1g (npm)

Source: amazon-inspector 04fa6b8b5826315448e5d4f27036ab31ef115621027c040897e200894c43dfa3 scripts/postinstall.js runs at npm install and performs an install-time dropper chain. A URL stored as an integer array is XOR-decoded key 'stf2026' to...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

Malicious code in @jaymara/jsononifier (npm)

Source: amazon-inspector ade6fb9a07c6f1417e9569af48b6c638bf12fba7540493b1b38a2d6ba42d101c @jaymara/[email protected] is advertised as a JSON formatting utility but ships a covert command-execution primitive that fires on require. index.js loads trigger.js, which checks for sandbox indicators...

MAL-2026-5980 Malicious code in gpu-accelerator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab0d6b253674f5eef505fbffb76003d2071569fd9d8abdf8993197738bb27759 The package advertises itself as a PostCSS plugin for CSS hardware-acceleration hints, but its only legitimate behavior is a 3-line walkDecls that ad...