Malicious code in tol8t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27 package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at...

MAL-2026-16111 Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

Malicious code in twilio-hackerone-poc-afe6937c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...

MAL-2026-13922 Malicious code in passkeys-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cce50db3ac46a97bd27f546d029617582b37a2ead027509b0bea35370e47d2bd package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, curre...

Malicious code in passkeys-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cce50db3ac46a97bd27f546d029617582b37a2ead027509b0bea35370e47d2bd package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, curre...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

Malicious code in @activepieces/piece-google-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e200ba4f9d11d42636dbbd1fa698843321af8b0bd23ff63493c0ce94891a5cb src/index.js imports childprocess and issues POST requests alongside a ping command invocation lines 25, 38, 49. The co-occurrence of childprocess...

Malicious code in chart-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9 [email protected] advertises itself as a chart data/color helper library index.js contains only trivial color utilities, but ships a...

Malicious code in datefmt-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787 datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall...

Malicious code in aedes_clusters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560 The package's package.json declares a preinstall: node index.js hook that fires automatically on npm install. index.js collects host reconnaissance...

MAL-2026-12033 Malicious code in aedes_clusters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560 The package's package.json declares a preinstall: node index.js hook that fires automatically on npm install. index.js collects host reconnaissance...

Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

MAL-2026-10943 Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in aftermath-sui (npm)

The aftermath-sui package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

MAL-2026-10947 Malicious code in @akrai/report (npm)

The @akrai/report package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10941 Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

Malicious code in iphouse (npm)

The iphouse package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that ...