Malicious code in nwfp-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905a5825cb8abf7b385b98cfade02c315a4bc776bc37cfacd5ab20d5b8d03640 On require of nwfp-build-config, index.js loads lib/telemetry.js, which immediately runs an IIFE that reads the installer's hostname os.hostname and...

MAL-2026-18107 Malicious code in nwfp-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905a5825cb8abf7b385b98cfade02c315a4bc776bc37cfacd5ab20d5b8d03640 On require of nwfp-build-config, index.js loads lib/telemetry.js, which immediately runs an IIFE that reads the installer's hostname os.hostname and...

Malicious code in css-yhpodl-polyfill (npm)

Source: amazon-inspector 5936fc65b4eba7b461c0eef7b66dfeecdc2da412f54fd667873e3e6950b0a857 css-yhpodl-polyfill ships thunderboltRegistry.js which, as an IIFE executed on require, runs shell reconnaissance id, whoami, env, ifconfig/ip addr, hostname via childprocess.execSync and sends the collected...

Malicious code in @baanx/abis (npm)

Source: amazon-inspector 647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b Package declares scripts.install: node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username os.userInfo.username, hostname os.hostname, and current...

MAL-2026-16353 Malicious code in @insiderintelligence/componentlibrary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993 The package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That...

Malicious code in functions-framework-nodejs (npm)

Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node install.js, and install.js runs execSync"id" on the installer's...

Malicious code in functions-framework-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node...

MAL-2026-13951 Malicious code in functions-framework-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node...

Malicious code in @years19/n8n-nodes-utils-helper-f (npm)

Source: amazon-inspector 0200e9a9dfdd3de819e8111363492aa235bd40790b89adc91a5d7e0a410ae120 The package's postinstall scripts.postinstall: node callback.js collects host identity and environment fingerprint output of id, hostname, Python user-site path with its contents filtered for offensive-tooli...

MAL-2026-13900 Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

MAL-2026-12491 Malicious code in uploader-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911 The package's scripts.install runs node index.js, which loads ./lib/core and, on npm install, collects the installer's OS username via...

Malicious code in workrally (npm)

Source: amazon-inspector 502275ca25c6fb0e28db57d91789be11e347b5f21696ed45e15c015d123eaf51 dist/index.js imports childprocess and runs whoami observed at multiple call sites, then POSTs the result to a hardcoded remote URL https://workrally.qq.com. This is the classic host-identity exfiltration...

Malicious code in @payment-review/store (npm)

Source: amazon-inspector 2d624eaefbb0245bf0c9a7b598c461a3ba5ec48005cfec223898062741ef8c2e package.json declares preinstall: node index.js || true, so installing the package automatically runs index.js on npm install. The script collects host identity fields — os.hostname, os.userInfo.username,...

Malicious code in @listings/energy-labels (npm)

Source: amazon-inspector 41caac3ab1f9c35a72841357174aeeec16c142c08cc28030a875b2dba85f04ba The package declares "preinstall": "node index.js || true" in package.json, so on every npm install the script executes automatically and silently swallows errors. index.js collects host identity os.hostname...

Malicious code in @card-pci-data/store (npm)

Source: amazon-inspector 9a82d7b7e7588c4b773e2948eb1707e62f2fcece2bec37a23eda5d5058eae871 On npm install, the package's preinstall hook scripts.preinstall: node index.js || true runs index.js which collects host identity — os.hostname, os.userInfo.username, dirname, and process.cwd — and...

Malicious code in @w2d/web-components (npm)

Source: amazon-inspector 2b8292b80f3e692b249561a14d94d2dfa0196f2377e7eee027b8dd630d251bd1 The package targets the @w2d scope with an artificially high version 2.999.999 — the canonical dependency-confusion shape designed to outrank an internal registry's real package. On npm install, postinstall....

Malicious code in @httpactions/strict-uri-encode (npm)

Source: amazon-inspector b90fd30f5d52b139ea7be77aa1782a5339f39355ec7ad532af2fa7a49616ff88 @httpactions/strict-uri-encode impersonates the popular unscoped npm package 'strict-uri-encode' 30M weekly downloads by republishing the same name under a lookalike scope. The package ships no URI-encoding...

Malicious code in gd-auth-client (npm)

Source: amazon-inspector 4de00613e21b42bf3c651995beae63ff9d85772b9370145152d172a062be4fb7 package.json declares preinstall: node index.js, which runs automatically on npm install. index.js requires os, dns, https, querystring, and the local package.json, then collects installer host identifiers —...

Malicious code in pipo-sdk (npm)

Source: amazon-inspector 259159c0505b819905dcaf53172d98a4fd590a9ae1a40f87d2be4c1a7fdc4065 This package is a dependency-confusion payload published at an abnormally high version 9999.0.0 targeting an internal package name pipo-sdk. The preinstall lifecycle hook runs node callback.js || true, which...

Malicious code in fmt-date-lite (npm)

Source: amazon-inspector 1c8dad7bd90f4cb0dbb1d4ce933bc39f04aefe4940a53605e5c3f30c48a313e4 On npm install, the package's postinstall lifecycle script runs the id command and transmits the resulting user/group identity to a hardcoded bare-IP endpoint at http://155.190.124.243:6788/ over plain HTTP...