Malicious code in eth-codegen (npm)

Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper. index.js appends an async runHandler concealed after 1KB...

Malicious code in vite-json-config (npm)

Source: amazon-inspector 9a7c9683fed8b8696938eb7ad88e158f70a075851b0dd511af991ecd69a4d0fd The package presents itself as a vite/tsconfig path helper and clones the public API of tsconfig-paths createMatchPath, matchFromAbsolutePaths, register, loadConfig. A new exported configJson entry point...

Malicious code in chai-test-mocks (npm)

Source: amazon-inspector 61a1bfd9f5d478d2cc7c947470544e99015a830dd5ecbb7ad8cdb54976c8d6ef chai-test-mocks impersonates the legitimate chai-jest-mocks package replicated README, reused CircleCI/coveralls badges pointing at chai-jest-mocks but overrides module.exports to a dropper rather than the...

Malicious code in jwtmode (npm)

Source: amazon-inspector b59454613cc025e514269f55b41a9da6a5da1db70e73e583bc79d97727e9528a On require'jwtmode', decode.js immediately invokes getThirdCookie, which performs an HTTP GET to https://jsonkeeper.com/b/AZ9ZF, takes the response field response.data.errCode, passes it to new...

Malicious code in unifydata (npm)

Source: amazon-inspector 0c62d93328810f03f3aac73777f406eee1b3413e1c3320eb87f3445754dba9d3 On require'unifydata', index.js calls initPlugin at module top level, performs an HTTPS GET to https://jsonkeeper.com/b/B40HL, JSON-parses the response, and executes the response's cookie field as JavaScript...

Malicious code in path-internal (npm)

Source: amazon-inspector 5393cf6d8cf49c2550e7cc90ff3de58b1e97bdc89183f63beae60b3e46b9d2e0 The package presents itself as a copy of the Node.js core path module name path-internal, README: "exact copy of the NodeJS 'path' module" and ships the upstream Joyent path implementation with a malicious...

Malicious code in jwtmethod (npm)

Source: amazon-inspector 3dbd06d83019ce10a1c0da788fc10633f55f9f6c82058ca6841c4650b5611afb On module load, jwtmethod's decode.js executes a top-level routine that performs an HTTPS GET to https://jsonkeeper.com/b/E69V3 and passes the response body to new Function.constructor'require', errCode, the...

Malicious code in pipspeed (PyPI)

Source: amazon-inspector b1037d713fe94f92e9f1302a1c8fdfcd03ee290e1f2076e7c01cbd1305499e91 The package's advertised public entry point pipspeed.optimize GETs a JSON document from https://www.jsonkeeper.com/b/53XMN an anonymous, mutable paste host and reads package, function, and args fields from t...