MAL-2026-13970 Malicious code in @hzero-front-ui/hzero-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1b33c04eb2fb12d521b76353993517475d9239c9790c085d16c0c3d0a4ba2f9 Package @hzero-front-ui/[email protected] is a scope-lookalike of @hzero-front/hzero-ui with a placeholder version, empty author, generic description...

Malicious code in @hzero-front-ui/themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac0df9dcfaeaf0958ef981d9c5cd9dd4ab1fe0de41bd20894c261dade6bb486 package.json defines preinstall and install lifecycle scripts that run automatically on npm install. The scripts collect the installer's whoami,...

MAL-2026-13971 Malicious code in @hzero-front-ui/themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac0df9dcfaeaf0958ef981d9c5cd9dd4ab1fe0de41bd20894c261dade6bb486 package.json defines preinstall and install lifecycle scripts that run automatically on npm install. The scripts collect the installer's whoami,...

MAL-2026-13753 Malicious code in dcfarguscert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d [email protected] registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host...

MAL-2026-13737 Malicious code in @openzeppelin-4/contracts (npm)

@openzeppelin-4/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v4 line via the look-alike scope @openzeppelin-4, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

Malicious code in truffle-helper (npm)

Source: amazon-inspector 27652f23529349a6999e9121bc9714a5e9b5d11b227729c3c24147e5d2260eee package.json line 7 invokes require'childprocess' and execSync'curl...' from an npm lifecycle script. This causes the installer's machine to fetch and execute remote content at install time, without user...

Malicious code in @orion-design-system/foundation (npm)

Source: amazon-inspector 3e7fdf1bb78d6c3750adffa854f5f08c7f2fd7af6166f7234aa5cbf4974a1375 The package's npm preinstall lifecycle script runs an inline node -e payload that collects the installer's hostname os.hostname and OS username os.userInfo.username and transmits both to an attacker-controll...

Malicious code in logfmt-core (npm)

Source: amazon-inspector bb22b2557674e7d616805d8a4086d69e02896be169b9e5d4d053eb3628ebe038 On npm install, scripts/install-check.cjs registered as a postinstall lifecycle script fetches a JSON config from a hardcoded anonymous Vercel app URL...

Malicious code in @remitee-money-transfer/rmt-base (npm)

Source: amazon-inspector 5f21c6601855c2f2d0a5d0761d3defe8c0ba1708dd2a67fb278c03e0abd6ba16 Package ships only a preinstall lifecycle script scripts/preinstall.sh and no functional code. On npm install, the script reads /etc/passwd and /root/.ssh/idrsa, fetches the host's public IP via ifconfig.me,...

Malicious code in insomnia-plugin-poc-m4gester2 (npm)

Source: amazon-inspector 1b2b63f22e7d0d8f23c608a3c109163e06e2bd6a1dd716305e0d8adaf6be6b86 Package ships only a package.json with no plugin code, declaring a postinstall lifecycle script that runs echo PWNEDBYDEEPLINK /tmp/pwned.txt on every npm install. This writes a marker file to the installer'...

Malicious code in @iana-rzms/bff-sdk (npm)

Source: amazon-inspector b7adbad0c719aec3345c5aa16b3435e8621f4a81b5a0e0cf0e0d979509e5d21f Package published to the public @iana-rzms scope as a dependency-confusion squat targeting an internal ICANN namespace. The preinstall lifecycle script runs automatically on npm install and collects the...

MAL-2026-4804 Malicious code in @leviyuan/lodestar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c295b3a16fad72f7b165d049e75feb88883dcc1b5b8d9d72b52ac7b40aa09ba The package ships a lifecycle-invoked script dist/lodestar-setup.js that performs an HTTP POST to a hardcoded https://open.feishu.cn endpoint, with...