Malicious code in service-roles-registry (npm)

service-roles-registry runs code during npm install that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint: - 99.0.2 published 2026-11-02 17:53 UTC: its preinstall script is node index.js, which npm runs during npm...

Malicious code in stdid-nyxprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ccf3f03f309715ca11fb3863aa89a57d4c0550606cb17839bfff9b5dfd34687 The package installs stdidnyxprobe.pth into site-packages, whose sole content is import stdidnyxprobe.beacon. Python's site.py mechanism evaluates th...

Malicious code in @ppa-web-components/ppa-searchform (npm)

Source: amazon-inspector c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c The package ships a beacon.cjs that is wired to run both via the postinstall lifecycle script and from top-level index.js on require. On execution it collects host identifiers hostname, install path, current...

Malicious code in @greenlake/common-context (npm)

Source: amazon-inspector 5c391fc0f0acc51479adc96cdca5e63497f47dd4304eb0a871819bce9313551e @greenlake/[email protected] is a stub package whose main entry exports a Proxy of no-op functions and whose only real behavior is a beacon. Both scripts.postinstall node beacon.cjs and require of the ma...

Malicious code in @drone-js-ext/core (npm)

Source: amazon-inspector 9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43 The package ships a beacon.cjs that collects host identifiers hostname, install path, current working directory, Node version and POSTs them in cleartext to the hardcoded bare-IP endpoint...

Malicious code in @drone-js-ext/vip-badge (npm)

Source: amazon-inspector 2f7afa65da63d3360d15659ebdcce5f5078fa7bd210e04c069f88834f0c1f75c The package is a zero-functionality stub whose main module index.js exports a Proxy returning no-op functions for any property access. Its only real behavior is a beacon implemented in beacon.cjs that collec...

MAL-2026-18287 Malicious code in @ppa-web-components/ppa-searchform (npm)

@ppa-web-components/ppa-searchform is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.0, 1.0.1, 2.0.1, 0.0.1, 3.0.0, 1.1.0, 99.0.1, 2.0.0 has a...

Malicious code in @ppa-web-components/ppa-searchform (npm)

@ppa-web-components/ppa-searchform is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.0, 1.0.1, 2.0.1, 0.0.1, 3.0.0, 1.1.0, 99.0.1, 2.0.0 has a...

Malicious code in @drone-js-ext/core (npm)

@drone-js-ext/core is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 1.0.0, 2.0.1, 3.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry install...

MAL-2026-18276 Malicious code in @drone-js-ext/core (npm)

@drone-js-ext/core is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 1.0.0, 2.0.1, 3.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry install...

Malicious code in @drone-js-ext/vip-badge (npm)

@drone-js-ext/vip-badge is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 0.0.1, 1.0.1, 2.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry...

MAL-2026-18277 Malicious code in @drone-js-ext/vip-badge (npm)

@drone-js-ext/vip-badge is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 0.0.1, 1.0.1, 2.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry...

Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 99.0.1, 3.0.0 has a postinstall script that runs node beacon.cjs on npm...

MAL-2026-18282 Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 99.0.1, 3.0.0 has a postinstall script that runs node beacon.cjs on npm...

Malicious code in @ecg-internal/js-react-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 533583f613bf03556a1660b5bd8eaf4d5899c96dc79f4c42ae6b883aea8fde0e The package is published under an internal-looking scope @ecg-internal and ships a stub main module that returns a Proxy of no-op functions for every...

MAL-2026-18206 Malicious code in @ecg-internal/adobe-dmp-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a24a1672f5d2075c0159dee85aaad5dcb27d0cdc7eb6e007bfdbb742b82149f Package uses the @ecg-internal/ scope resembling an internal namespace and ships a minimal stub whose only effect is to beacon host identifiers to a...

Malicious code in @ecg-internal/adobe-dmp-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a24a1672f5d2075c0159dee85aaad5dcb27d0cdc7eb6e007bfdbb742b82149f Package uses the @ecg-internal/ scope resembling an internal namespace and ships a minimal stub whose only effect is to beacon host identifiers to a...

Malicious code in nested-lib (npm)

Source: amazon-inspector 0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928 The package declares scripts.postinstall = "node beacon.cjs" and index.js also invokes require'./beacon.cjs'.fire at module load. beacon.cjs POSTs a JSON payload containing os.hostname, dirname, process.cwd,...

Malicious code in another-very-long-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea9e3cf3d973c07d09048435d4ddc496574ce222d650c228b1400d866ea3ccf [email protected] ships a beacon.cjs that is invoked both from the declared postinstall lifecycle script and from the module's require-tim...

MAL-2026-17767 Malicious code in another-very-long-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea9e3cf3d973c07d09048435d4ddc496574ce222d650c228b1400d866ea3ccf [email protected] ships a beacon.cjs that is invoked both from the declared postinstall lifecycle script and from the module's require-tim...