MSC-2026-12294

glob-helper 1.0.1 is a malicious npm package published by owner in.t.re.p.i.d.n.m.w. Its postinstall script node postinstall.js harvests npm auth tokens from /.npmrc, /.git-credentials, .env files NPMTOKEN, AWS keys and npm lines from /.bashhistory, plus hostname and username, and sends them by...

Malicious code in glob-helper (npm)

Source: amazon-inspector 091b8ee02b80a8a3fda11c15a6d0b8f657b639100244a4398d046ded5854eb64 [email protected] is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares scripts.postinstall: node postinstall.js, which fires automatically on npm install...

Malicious Package

Overview glob-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in glob-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091b8ee02b80a8a3fda11c15a6d0b8f657b639100244a4398d046ded5854eb64 [email protected] is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares scripts.postinstall: node...

MAL-2026-3764 Malicious code in glob-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091b8ee02b80a8a3fda11c15a6d0b8f657b639100244a4398d046ded5854eb64 [email protected] is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares scripts.postinstall: node...