Malicious code in csa-mfa (npm)

Source: amazon-inspector 959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9 package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command substitution of whoami, ls, and hostname. On npm install this...

Malicious Package

Overview csa-mfa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in csa-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9 package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command...

MAL-2026-16175 Malicious code in csa-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9 package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command...