Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

Malicious code in tinkoff-fb-app-frame-page-height-dippy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db9a5313417dcbe6f8514736de7dd82892ad5cdccc261e0064d8f76f8d9613e On require, index.js loads platform.js, which reconstructs C2 hostnames via runtime string concatenation joining fragments such as...

Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...

MAL-2026-11975 Malicious code in http-metrics-middleware (npm)

npm/http-metrics-middleware is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/carto-charts-rn (npm)

npm/@servicetitan/carto-charts-rn is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/startup (npm)

npm/@servicetitan/startup is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

MAL-2026-11886 Malicious code in @servicetitan/ld-type-generator (npm)

npm/@servicetitan/ld-type-generator is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10b67ca39014513878a16bd2459cd4f1e6ebf24934aa5784df51b9acc766f264 The package extracts the AES-256-GCM master key for a separate product lark-cli from the macOS Keychain via security find-generic-password -s lark-cl...

Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47761909a1686ad1db2239f5055c8526e38ac88c07060c886157d157d15b4315 package.json declares a preinstall script that runs node index.js on npm install. index.js collects host identifiers os.hostname, os.platform, os.arc...

MAL-2026-11006 Malicious code in n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9256e5f20f66f3eb9875dcc475299249173730d784230eb157c327171d114e21 The package advertises itself as an n8n community node 'Utility nodes for n8n', but the declared community node file MyNode.js is an empty stub and t...

MAL-2026-10721 Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

Malicious code in @whalent/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

MAL-2026-10590 Malicious code in openaiwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...

MAL-2026-10579 Malicious code in bimi-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo...

MAL-2026-10536 Malicious code in n8n-nodes-social-facebook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff182b11223b46877e54226944a8ba245ad486dd9dfd1027810a42f9c9e06a1 This n8n community node advertises Facebook automation and instructs the operator to paste a full Facebook session JSON captured via a Chrome extensi...

Malicious code in permcarmserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...

MAL-2026-10455 Malicious code in @origindev/ethaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21a07b9029fb9a0c16ec0d934edab2123c43d1999489d510c3bbabc5a0f1d5e7 @origindev/[email protected] ships a single heavily obfuscated index.js wrapped in an RC4 string-array decoder with IIFE rotation and a self-defending...

MAL-2026-10462 Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

MAL-2026-10432 Malicious code in animated-css-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257 The package presents itself as a PostCSS plugin for animate.css, but its main export src/plugin.js createPlugin synchronously triggers...