MAL-2026-16313 Malicious code in test1gg234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...

Malicious code in lodsh-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273 lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it...

Malicious code in typecript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03604fc37a8607bf5c14f409dc9d13308bff3e7ec145de955ae13a07c13da92e [email protected] is a typosquat of 'typescript' whose scripts/postinstall.js performs an install-time dropper attack. Payload strings are stored a...

Malicious code in nms-dashboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601 [email protected] declares an npm install lifecycle hook scripts.install: "node index.js" that unconditionally requires ./lib/core inside a...

Malicious code in markscan-reports (npm)

The markscan-reports package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

MAL-2026-10950 Malicious code in @iphouse/core (npm)

The @iphouse/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10951 Malicious code in @markscan/api (npm)

The @markscan/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in bvm-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87ff2c7d903c5594ba5fa2e11d3fe6281380a5f2d010a1a0e3c0679464ab1fca dist/index.js in [email protected] imports childprocess and issues fetch calls to the hardcoded host https://bvm-core.nexsail.top at the top of the...

MAL-2026-10683 Malicious code in formatters.ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21827129edc8dbde114c615df656d5a234d1fbcfa5b9f63d5286d781253e8f2b The package declares a preinstall hook that runs index.js on npm install. index.js collects host and identity reconnaissance — os.hostname,...

MAL-2026-10551 Malicious code in elsisi-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4deec3de3ca46a57023580a81da870e3ce444a691ad6f42f5217abe206ef448a package.json declares preinstall and postinstall lifecycle scripts that invoke wget against https://webhook.site/d5968c3d-d0d7-46c4-9305-a726b24fce9c...

Malicious code in api-changelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname,...

MAL-2026-10159 Malicious code in npm-rce-safe-proof-yourname (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fdedc15d959d978bd3563d29d16c5ab226d3c4fa4ab8b6fecf8bdf130e29ab On npm install, postinstall.js runs whoami, reads os.hostname, process.platform, and process.version, and transmits them via HTTPS GET to a hardcoded...

Malicious code in dc-repro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b27530f3aa6f2f96c3aa77ffad048e51ee4479d60c81ce59687772b6985a99b On npm install, postinstall.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://130.49.177.51:18080/p/dc-20260627-yandex-geobase carrying...

MAL-2026-10080 Malicious code in webrix-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host reconnaissance data — os.hostname,...

Malicious code in ronyfortest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c9f63368f7e1147ade261a87f45e32e13bcf79b5336efad59087ce85e64a849 The package's postinstall hook node index.js runs automatically on npm install and collects the installer's OS username os.userInfo.username, hostnam...

Malicious code in sheratan_test_p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 472354ac3cd0bba5d399eea2f09e4b7f60cb2cb65e20d4af0f6398882403f566 On npm install, the package's postinstall.js executes whoami via childprocess and POSTs the output along with stderr, error, and a timestamp to a...

Malicious code in utils-common-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6999f05f6036baf4f6d45de0c55c6dd63452dc59ab6ebcbad0ffebf93e60584 package.json declares a postinstall lifecycle hook that runs curl -s http://8.140.205.78 -o /dev/null on every install. The package's only functional...

Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...

MAL-2026-5418 Malicious code in @nstrlabs/api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7b47a7f81209dbbaff286599b46f4f030ff992b6d0c25d947cc84739b838d9 @nstrlabs/[email protected] is a hollow package whose only behavior is an install-time exfiltration beacon. package.json declares "preinstall": "node...

Malicious code in audit-logsss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f1d266fef23fc79d6af52affefa68c2220baad023d09a7acc4d439a23dfdb69 The package's postinstall script executes shell reconnaissance id || ver && whoami && hostname, fetches the installer's public IP from api.ipify.org,...