Malicious code in github-app-sts-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9434f2e4ac17da4d2b9dff0c36ed8b3c5cc3f76882b9898b768e78ba982bbac2 The package declares a preinstall lifecycle hook that runs index.js on npm install. index.js collects host identifiers and system files os.hostname,...

MAL-2026-10628 Malicious code in ai-explain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2b6beb476c828df723da0a2b4b524cf671e2eed9223a6e04c45c0ec4d59172 [email protected] ships a postinstall hook dist/postinstall.js, mirrored from scripts/postinstall.js that, on npm install, collects the installer's OS...

Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

Malicious code in @omniwatch-wick/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd38262e49e1e621fb0a2c3763f2736b2c893f18f24b5d019fc3febdc9ad172 index.js imports childprocess, os, http, and https, and issues POST requests to two hardcoded endpoints:...

Malicious code in library-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...

MAL-2026-10081 Malicious code in webrix-docs1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20cdefe1415c5b5245f36b10ea0de9033433b479768c2cc785ad2742b9433fce The package declares a preinstall hook node index.js that fires automatically on npm install. The script requires childprocess, os, https, and http,...

Malicious code in @wagni_bot/bsc (npm)

The npm package @wagnibot/bsc is a supply-chain credential stealer disguised as a BNB Smart Chain BSC SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...

MAL-2026-6099 Malicious code in stream-read-35cf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0597f71a1c39a743a4323636794601b480a1cda0c64df20d6bafa7ed601da84e Package declares a postinstall hook "postinstall": "node run.js" that auto-executes run.js on npm install. run.js imports os, fs, http, https, and...

MAL-2026-5778 Malicious code in hemi-earn-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9c2a72c75e835bc78738de0839bd4727df93d6bcb8aed2215289973996c4f3c On npm install, the package's preinstall script postinstall.js collects host metadata hostname, username, cwd, npm config and iterates process.env,...

MAL-2026-5570 Malicious code in nim-submit-for-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bf75301042574897cc2f4bd8f3b8939fe4ac7a958f2cfe2404bbbee149797d0 On npm install, the package's postinstall hook executes lib/compiler.js, which spawns a detached Node process that collects host identity hostname,...

MAL-2026-5407 Malicious code in @card-pci-data/store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a82d7b7e7588c4b773e2948eb1707e62f2fcece2bec37a23eda5d5058eae871 On npm install, the package's preinstall hook scripts.preinstall: node index.js || true runs index.js which collects host identity — os.hostname,...

MAL-2026-4565 Malicious code in fnd-stores (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c9035e303ec731c71c689ed77eed17b245cd4adc475cb616ff94991539aa56 On npm install, the package's postinstall hook runs node index.js, which collects the installer's hostname, OS platform, current working directory, C...

MAL-2026-4738 Malicious code in zest-product (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9081ad708b658c1bd56299e401ca6a764cc9137d99573bc922d38a7381cc30d On npm install, postinstall.js collects host identity and environment data os.hostname, username, process.cwd, process.env values, plus shelled-out...