Malicious code in research-probe-6150c1c915 (PyPI)

Source: kam193 a646eaf4fe72ba013abc53d52c0bf017a9c4f3bfc54a8c358f9f246d3ac41945 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a loca...

Malicious code in @galicia-toolkit-nestjs/commons (npm)

@galicia-toolkit-nestjs/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

MAL-2026-17455 Malicious code in dedh-devops-automation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-17251 Malicious code in @hrmony/app-gateway-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d3f05113dd7daa9fac2da8187afecc751fafcf96449e7f4eb4a5d9a4878844 On require/import of @hrmony/app-gateway-templates, index.js the package main executes an exfiltration routine against a hardcoded attacker endpoint ...

Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

MAL-2026-17183 Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

MSC-2026-11478

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Malicious code in btcflip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970 The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory C:\Users\Documents\Monero on...

MAL-2026-13619 Malicious code in atlas-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdd4a17504623add1ff4f374ea9c2283d1eb5a863265e012592142b169cd9d90 setup.py overrides the egginfo command to execute automatically during pip install. The overridden command collects the installer's hostname, current...

MAL-2026-13487 Malicious code in flasq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6 setup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux,...

Malicious code in llm-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7 On npm install, postinstall.js unconditionally runs runSetup which wires the package into the installer's AI tooling and stands up long-lived...

MAL-2026-13345 Malicious code in hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a102f1d05a0bd89af765e457c2b5d6121ec831d33549d0cbf9795d58b0d3ee6 hd-key-generator is a typosquat of the hdkey package. On require, index.js reads process.env, os.hostname, os.userInfo.username, the user's home...

MAL-2026-13215 Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

Malicious code in gs-uitk-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58475142ea32c554345513c67fd5ed8a8d6b60fb151e675249e4eb83984c8300 [email protected] declares an npm install lifecycle script scripts.install='node index.js' that loads lib/core.js. That module collects th...

Malicious code in dynstrg-howto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 800fab99d95f1a2cef6ebf269ca240bf60518735cfb58c7c24b6a8474c72ee77 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...

Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

MAL-2026-12498 Malicious code in wagmi-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...