MSC-2026-6393

Dependency-confusion attack, escalated variant of 99.0.0, same webhook https://test.v3n.my/pwn. preinstall+install+postinstall all run 'node index.js'. Adds require'fs', safeExeccmd,shell:true,timeout:10000, an UNCONDITIONAL top-level posttype:'exfil' at module load before the try block, and a...

Malicious code in vestibulect (npm)

Source: amazon-inspector 82da0f0bb40f42e69defbea694db093f2ad880c8c094508f61e2d7fe58550e2e package.json declares a postinstall hook "postinstall": "node install.js" which executes install.js automatically on npm install. install.js imports fs and https, enumerates the filesystem via...