Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

Malicious code in twilio-hackerone-poc-afe6937c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...

Malicious code in passkeys-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cce50db3ac46a97bd27f546d029617582b37a2ead027509b0bea35370e47d2bd package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, curre...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

Malicious code in @activepieces/piece-google-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e200ba4f9d11d42636dbbd1fa698843321af8b0bd23ff63493c0ce94891a5cb src/index.js imports childprocess and issues POST requests alongside a ping command invocation lines 25, 38, 49. The co-occurrence of childprocess...

Malicious code in chart-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9 [email protected] advertises itself as a chart data/color helper library index.js contains only trivial color utilities, but ships a...

Malicious code in datefmt-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787 datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall...

Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

MAL-2026-10943 Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in aftermath-sui (npm)

The aftermath-sui package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

MAL-2026-10941 Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

MAL-2026-10947 Malicious code in @akrai/report (npm)

The @akrai/report package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

Malicious code in iphouse (npm)

The iphouse package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that ...

MAL-2026-10948 Malicious code in @akrai/report_new (npm)

The @akrai/reportnew package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

MAL-2026-10744 Malicious code in patchwork-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9 dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference line 286, matching a...

MAL-2026-10731 Malicious code in date-utils-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bd644fd9a59518d6f77e8d76c077ffef8a2afdc7ae2b00a6ca87299879a671 Package presents itself as a trivial date-formatting utility index.js exports a one-line ISO date helper but ships a postinstall.js that runs...

MAL-2026-10634 Malicious code in estore-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...

MAL-2026-10585 Malicious code in cheeriobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which...