Malicious code in bq-helix-build-hook-6ade983e (PyPI)

Source: kam193 ee26602dfa25f574d440b2c1e8ef0a9516fdfb5db4b59f995b88784332476413 During installation the code collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them. --- Category: MALICIOUS - Th...

Malicious code in bq-helix-build-hook-6ade983e (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ff13fe63e15fdf4130e7219776edbe4d34fe2c2b83011099a0ddec9c10ebf6 On pip install, setup.py collects the full process environment dictos.environ, process command lines, and /proc/self/status,cgroup,mountinfo,fd, and...

Malicious code in solaan-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/solaan-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minute...

MAL-2026-17610 Malicious code in solaan-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/solaan-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minute...

Malicious code in @shwfed/nuxt (npm)

Source: amazon-inspector 87ac343d6f89a601749bb115fa6902e7d39c71a0a6469690ecef56e9ea8a135e @shwfed/nuxt is published as a Nuxt UI module but contains undocumented build-hook code that, when a consumer integrates the module and runs a build under CI, POSTs the consumer's CI/build metadata and recen...