Malicious code in pkg-telemetry-r4f9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector decf727db779a7cc4017b0bd8000f9fb40bcc5c6d93b016144a94e245886ea4e On install, package.json's postinstall hook runs node run.js, which loads beacon scripts that combine childprocess, os, and http modules to collect...

MAL-2026-5990 Malicious code in pkg-telemetry-r4f9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector decf727db779a7cc4017b0bd8000f9fb40bcc5c6d93b016144a94e245886ea4e On install, package.json's postinstall hook runs node run.js, which loads beacon scripts that combine childprocess, os, and http modules to collect...

Malicious code in runtime-metrics-w7k2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c2062a3f2564ced7261d9b8be8a49e11117bd74ffe3e92aad6029c471921e2d Package declares a postinstall hook "postinstall": "node run.js" that fires automatically on npm install. The tarball ships beacon scripts beacon18.j...

MAL-2026-5992 Malicious code in runtime-metrics-w7k2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c2062a3f2564ced7261d9b8be8a49e11117bd74ffe3e92aad6029c471921e2d Package declares a postinstall hook "postinstall": "node run.js" that fires automatically on npm install. The tarball ships beacon scripts beacon18.j...

Malicious code in npm-sandbox-ping-r9t2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 335649d395a44d7de1bc6343dbce1f0459414ef92ab149413a86b47e28f3c7c3 package.json declares a postinstall hook "postinstall": "node run.js" that auto-executes on install. The package ships beacon scripts beacon14.js,...

MAL-2026-5986 Malicious code in npm-sandbox-ping-r9t2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 335649d395a44d7de1bc6343dbce1f0459414ef92ab149413a86b47e28f3c7c3 package.json declares a postinstall hook "postinstall": "node run.js" that auto-executes on install. The package ships beacon scripts beacon14.js,...

Malicious code in canary-ci-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a572fd7ffa39ecc1ba62c71d1dfe31722bfbe0c4118b7ab8400c1d5f4a61ba0f On npm install, the package's postinstall lifecycle script postinstall.js collects installer-side host identifiers — os.hostname, os.userInfo.usernam...

MAL-2026-5972 Malicious code in canary-ci-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a572fd7ffa39ecc1ba62c71d1dfe31722bfbe0c4118b7ab8400c1d5f4a61ba0f On npm install, the package's postinstall lifecycle script postinstall.js collects installer-side host identifiers — os.hostname, os.userInfo.usernam...

Malicious code in backoffice-charges-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 047eb92a0e8bb401b2c205765616c9b4b715ee7cfd33d2e6ef9dc8d645b77f04 On every npm install, the preinstall lifecycle script node index.js /dev/null 2&1 silently HTTPS-POSTs a JSON payload to https://avamnrwqo7.rbmock.de...

MAL-2026-5929 Malicious code in backoffice-charges-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 047eb92a0e8bb401b2c205765616c9b4b715ee7cfd33d2e6ef9dc8d645b77f04 On every npm install, the preinstall lifecycle script node index.js /dev/null 2&1 silently HTTPS-POSTs a JSON payload to https://avamnrwqo7.rbmock.de...

MAL-2026-5926 Malicious code in test-copppss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03106e028cee7749b7f3a9b327142fc0a402574bc72f3a62d129aa891afe85fe On npm install, the package's preinstall hook node index.js /dev/null 2&1 runs a shell pipeline that collects host identifiers — hostname, pwd, whoam...

MAL-2026-5911 Malicious code in utils-common-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6999f05f6036baf4f6d45de0c55c6dd63452dc59ab6ebcbad0ffebf93e60584 package.json declares a postinstall lifecycle hook that runs curl -s http://8.140.205.78 -o /dev/null on every install. The package's only functional...

Malicious code in react-hook-use-debounce-throttle-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0a4d8a0470a3e7fcb2da7cdb29ba6412125924a486aa6f4a437ccfbeb5ca4af package.json declares a postinstall hook that runs node -e to issue an HTTPS request to the bare IP 8.140.205.78 on port 80 with all errors silently...

MAL-2026-5909 Malicious code in react-hook-use-debounce-throttle-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0a4d8a0470a3e7fcb2da7cdb29ba6412125924a486aa6f4a437ccfbeb5ca4af package.json declares a postinstall hook that runs node -e to issue an HTTPS request to the bare IP 8.140.205.78 on port 80 with all errors silently...

Malicious code in uidai_reusable_components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5875a720dc1cfc6e30a67b003fc43975fbef2e11352e715e19e55e54dd84ae67 On npm install, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the installer's hostname, OS username...

MAL-2026-5910 Malicious code in uidai_reusable_components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5875a720dc1cfc6e30a67b003fc43975fbef2e11352e715e19e55e54dd84ae67 On npm install, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the installer's hostname, OS username...

MAL-2026-5898 Malicious code in strict-engine-peer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0913b30a168bfed09d3c5ae59aeaf6a305a395f86516fb1fb8ece60bb95904de On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads the installer's project...

MAL-2026-5894 Malicious code in create-vercel-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeaea6bab6360c38ed5a7de7065eb04d0ac489bb3670b68defc8bc26874d3d62 Package name mimics Vercel's official create- initializer convention e.g. create-next-app, targeting developers who mistype or guess the initializer...

Malicious code in @dsft/ft-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80ec07b8de5ed0e8cf43a8584075210d47e80e7bcc04368a5029f7637188db3 The package is a dependency-confusion proof-of-concept squatting on the @dsft/ scope. Its package.json declares a preinstall hook that runs index.js,...

MAL-2026-5890 Malicious code in @dsft/ft-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80ec07b8de5ed0e8cf43a8584075210d47e80e7bcc04368a5029f7637188db3 The package is a dependency-confusion proof-of-concept squatting on the @dsft/ scope. Its package.json declares a preinstall hook that runs index.js,...