Malicious code in typescipt-cli (npm)

Source: amazon-inspector b080f58ace02e860729134afd887943345248628e5c201a5fd2e46c71f439d29 Package name typosquats 'typescript'. scripts/postinstall.js runs at npm install time and: 1 POSTs a JSON body with the installer's platform label to 193.70.34.101:20099/vote, with the IP split into a string...

Malicious code in typescirpt-cli (npm)

Source: amazon-inspector 09d82fa51e42e6766fe0819517e9fb5be633702a0e22cb4da05d8920cb413c53 The package's postinstall script scripts/postinstall.js XOR-decodes obfuscated byte arrays using the key 'stf2026' to reconstruct a download URL and a powershell command. On Windows, and on Linux when WSL is...

Malicious code in chalk-es (npm)

Source: amazon-inspector 9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js. On install the script XOR-decodes key stf2026 a hardcoded GitHub URL and downloads a Windows...

Malicious code in tyepescript-core (npm)

Source: amazon-inspector f2ba91f9b227b017ddbfa6a908a0a8f0263292a0af2c11aeef0ccd24b2894862 Package name 'tyepescript-core' is a typosquat of 'typescript'; the module itself exports an empty stub. scripts/postinstall.js XOR-decodes byte arrays key 'stf2026' to reconstruct a download URL and shell...

Malicious code in lodsh-cli (npm)

Source: amazon-inspector 2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273 lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it XOR-decodes a hardcoded URL key 'stf2026' stored as an integer...

Malicious code in lodahsjs (npm)

Source: amazon-inspector 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318 Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it POSTs a platform label including a WSL/virtualized-Linux...

Malicious code in lodash-lib (npm)

Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm install, the postinstall script XOR-decodes key 'stf2026' a U...

Malicious code in loadashjs (npm)

Source: amazon-inspector 99f2ee2a45d09f0e66b8c9c6c4b3f2d19d39af009f71abffba1032b185fc4981 loadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall script POSTs a JSON body...

Malicious code in commandor-core (npm)

Source: amazon-inspector 3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab The postinstall script in [email protected] scripts/postinstall.js contains XOR-obfuscated byte arrays that decode at runtime unpackSegment with key 'stf2026' to a download URL at giphub.com — a typosquat...

Malicious code in raectjs (npm)

Source: amazon-inspector f75a611c33224c779330b8d5313702dc44f20d197dd96f62fb236982281b9d09 scripts/postinstall.js runs on npm install and performs two attacker-beneficial actions. First, it POSTs a JSON platform snapshot to the hardcoded bare-IP endpoint http://193.70.34.101:20099/vote, with the...

Malicious code in commandorjs (npm)

Source: amazon-inspector bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b [email protected] is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall...

Malicious code in commandor-cli (npm)

Source: amazon-inspector 75d139bce34f1d3290c34bb6da1c421bb579afb93672b44909ed0725eb70be3c The postinstall script in [email protected] scripts/postinstall.js XOR-decodes a hardcoded URL using key 'stf2026' that resolves to...

Malicious code in ladash-cli (npm)

Source: amazon-inspector 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js, which runs on npm install. The postinstall XOR-decodes key...

Malicious code in testingsmthb1g (npm)

Source: amazon-inspector 04fa6b8b5826315448e5d4f27036ab31ef115621027c040897e200894c43dfa3 scripts/postinstall.js runs at npm install and performs an install-time dropper chain. A URL stored as an integer array is XOR-decoded key 'stf2026' to...

Malicious code in tyepescript-cli (npm)

Source: amazon-inspector 8a867a5fc578cb6dcb759370e837d1a4c7e24f6db63c0c0f781e2c24995905e6 tyepescript-cli is a typosquat of typescript. Its scripts/postinstall.js XOR-decodes key stf2026 a set of obfuscated byte arrays that resolve to an attacker-controlled URL, a PowerShell bridge command, and...

Malicious code in chalk-util (npm)

Source: amazon-inspector 4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4 [email protected] is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm install, postinstall XOR-decodes an obfuscated URL key...

Malicious code in lodhash-cli (npm)

Source: amazon-inspector 73ad64f6c3a93b504c64c10175e325463652fafd741c36cfad433bed93f24cc8 lodhash-cli is a lodash-typosquat whose main entry index.js exports an empty object; the package's only behavior is a postinstall dropper. scripts/postinstall.js XOR-decodes key 'stf2026' a URL pointing at...

Malicious code in comand (npm)

Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux, with WSL detection to a hardcoded bare-IP endpoint at...

Malicious code in comander-cli (npm)

Source: amazon-inspector 8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626 comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All behavior is in scripts/postinstall.js, which runs automatical...

Malicious code in bqq1 (npm)

Source: amazon-inspector c8709cb6f826b8ee95c1d8aef1bb12c769c165260483b6a95be782af9dbeb2ba The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On require/start, index.js unconditionally executes startApp, which...