329637 matches found
Malicious code in tego-managed-agents-test (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...
MAL-2026-17183 Malicious code in tego-managed-agents-test (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...
Malicious code in app-sca-info-banking (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...
MAL-2026-17182 Malicious code in app-sca-info-banking (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...
MAL-2026-17169 Malicious code in @alphaspace/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...
MAL-2026-17176 Malicious code in n8n-nodes-moonlet-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec Package presents itself as n8n helper nodes but ships an empty stub index.js module.exports = and no functional node modules. On npm install,...
MAL-2026-17177 Malicious code in n8n-nodes-moonlet-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f49ee5bcbcb7e8f1028de4021134fdbbc895e737700cf82a834fb26d3b23dd05 postinstall.js fetches an opaque binary from https://mkicom.com/.well-known/pki-validation/ctdn8, writes it to /tmp/.nc, chmods it 0755, and launches...
Malicious code in n8n-nodes-flowstats (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aa25eb3d56eb14b75cbb4dedbd5d09063e4b742b53acef9a4096cc77213b8f3 The package presents itself as an n8n community node that annotates items with flow statistics, but nodes/FlowStats.node.js contains two independent...
MAL-2026-17175 Malicious code in n8n-nodes-flowstats (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aa25eb3d56eb14b75cbb4dedbd5d09063e4b742b53acef9a4096cc77213b8f3 The package presents itself as an n8n community node that annotates items with flow statistics, but nodes/FlowStats.node.js contains two independent...
MAL-2026-17179 Malicious code in wallet-connect-adapter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d The package's postinstall hook runs node./loader.js, which base64-decodes an 8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and...
MAL-2026-17171 Malicious code in agency-testts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that auto-runs on npm install on Windows. The bundled 4444.vbs is a 674KB...
Malicious code in secure-env3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb86188f9853b34c6dc3cf9c8259a789920326e8ddf4ae4cd3566385bba3ea1 The package presents itself as a dotenv-style environment loader but ships a Windows dropper that fires automatically on module load and on CLI...
MAL-2026-17172 Malicious code in better-dotenv3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf The package is a dotenv typosquat that runs a hidden Windows loader on every require and on CLI startup. dist/index.cjs and dist/cli.cjs invoke...
Malicious code in chromatitle-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with...
MAL-2026-17174 Malicious code in chromatitle-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with...
MAL-2026-17168 Malicious code in vercel-runtime-python (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f59b48451cf996ea42b291d60ed56205aeb9803222d156f7880fd6b92032b1c6 The package presents itself as a Vercel Python runtime helper but ships no runtime functionality. Its only substantive code path is a public function...
Malicious code in prosocks (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2bf0fd5f445eed9825601f2b4497502054176d106d4fecb9eabf38312dd582 prosocks 1.0.25 enrolls the installer's host as a remote-controlled SOCKS5 exit node under a hardcoded control plane at https://kalnetz.store...
MAL-2026-17167 Malicious code in prosocks (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2bf0fd5f445eed9825601f2b4497502054176d106d4fecb9eabf38312dd582 prosocks 1.0.25 enrolls the installer's host as a remote-controlled SOCKS5 exit node under a hardcoded control plane at https://kalnetz.store...
Malicious code in building-build (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4618f06d0398ff90ef90003464e79f23609a160f4d1606f60cf797fb73fa6dcb The package's sole content is index.js, which on load schedules a timer that fetches a hardcoded list of privileged same-origin paths /admin,...
MAL-2026-17164 Malicious code in building-build (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4618f06d0398ff90ef90003464e79f23609a160f4d1606f60cf797fb73fa6dcb The package's sole content is index.js, which on load schedules a timer that fetches a hardcoded list of privileged same-origin paths /admin,...