Malicious code in mutex-plus (npm)

Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...

Malicious code in mutex-core (npm)

Source: amazon-inspector 8c015af803d9d4adc7d0578dc27795ebaef48e6ce25e9bf715b54af1e4991999 The package is published under a name resembling the popular async-mutex library and, beyond advertised mutex functionality, contains a staged loader. lib/Mutex.js's Mutex.prototype.runExclusive checks wheth...

Malicious code in mutex-thread (npm)

Source: amazon-inspector e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097 The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes callback.meta.jobId === 'cross-chain-transfer', spawns lib/withLoad.min....