Malicious code in keroeltopkk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc Package [email protected] ships only a manifest and a beacon script server.js and wires it into every npm lifecycle hook...

Malicious code in pf25262 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb index.js contains a browser exfiltration snippet that issues a credentialed fetch to /profile, extracts a DGA... token or falls back to capturing...

MAL-2026-16332 Malicious code in feed-widget-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9c3f4f4751b0adffb78a311ee048162a853729a5dd1d0826593f394a4d663e2 On load, index.js schedules a setTimeout 2s that fetches the current origin's /profile endpoint, parses the returned HTML, extracts a.flag-value...

Malicious code in element-plus-vite-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b7636f89146191d649c38819e975fc41167a53276c66aea0b43789eb8d39338 On load main index.js → bin/cli.js, the package invokes tooling-bootstrap.cjs which walks up from the consumer project's cwd/INITCWD looking for one ...

MAL-2026-16327 Malicious code in catwrestlingbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host...

Malicious code in sorrawit-dev-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's...

MAL-2026-16328 Malicious code in catwrestlinghuman (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4045339387526c5db90832687d1691c2caddba3b9cb05006022704bf094653 package.json declares a postinstall hook node index.js. index.js is a 111KB blob composed exclusively of the JSFuck character set !+, which decodes a...

Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...

MAL-2026-16323 Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...

MAL-2026-16325 Malicious code in bulk-add-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023 Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects...

Malicious code in better-envforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...

MAL-2026-16324 Malicious code in better-envforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...

MAL-2026-16329 Malicious code in chai-as-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397fee7b80d73ee4c82892a746b2bab33a4cd2f71ef1ec4fe6fbbaa0bb270308 On require of the package, index.js loads lib/initializeCaller.js, which runs an IIFE at module load. The IIFE decodes a base64-concealed URL resolvi...

Malicious code in chai-as-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397fee7b80d73ee4c82892a746b2bab33a4cd2f71ef1ec4fe6fbbaa0bb270308 On require of the package, index.js loads lib/initializeCaller.js, which runs an IIFE at module load. The IIFE decodes a base64-concealed URL resolvi...

MAL-2026-16343 Malicious code in siriusbeyond (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically...

Malicious code in siriusbeyond (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically...

MAL-2026-16321 Malicious code in @siriusbeyond/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72 On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity hostname, username,...

MAL-2026-16330 Malicious code in commerce-materials (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d [email protected] declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects...

MAL-2026-16317 Malicious code in testmgkregme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 496e8021fd5e2626c503e2ceeed8349ff15c68c71a5f19d8a57c67e5f1b41863 npm package [email protected] uses a binding.gyp whose sources field employs GYP command-expansion eval-AES-eval construction has no legitimate...

MAL-2026-16311 Malicious code in test12vv36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be [email protected] declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a...