Malicious Package

Overview monitoring-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview core-js-gnz is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview studiocodeeligibility is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview lite-matte is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview botmaker-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tailwindcss-forms-styles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview focus-visible-polyfill-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview css-light-dark-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview css-interop-observer-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @angupar/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in lightinng-invoice (RubyGems)

Source: amazon-inspector 38a3cbc58408f7b8e0edb2aa678ba4765867b535513e8609be0d87e93687eca3 The gem lightinng-invoice is a typosquat of the Lightning/BOLT11 ecosystem duplicated 'n', homepage lightinng-invoice.dev whose advertised functionality is a decoy: lib/lightinng-invoice.rb exposes only a...

Malicious code in crypti-toolbox (RubyGems)

Source: amazon-inspector 5ec4d5d5915335d90b2f18b45b050936fa5d2db9d176d7d081bd8c292c7c6795 On gem install, the native extension script ext/crypti-toolbox/extconf.rb runs an environment-fingerprinting routine that bails out on CI runners, ephemeral/sandbox hostnames, generated or analysis-shaped...

Malicious Package

Overview personio-pipeline-projen is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview tiny-dom-focus-trap is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in etheremu.rb (RubyGems)

Source: amazon-inspector a82ac5d3f021ab23f4f461181f4150c12d672ef421b6f80c10dd8a307178442e The gem's extconf.rb, executed automatically during gem install, contains a base64-encoded Ruby payload that is decoded and eval'd inside a detached forked process. The payload XOR-decodes a hardcoded bare-I...

Malicious code in lightning-invoice-utils (RubyGems)

Source: amazon-inspector b1c7aa63129491dc29eaf240d8f4ae910733b8f6f34192279c119c3cb585c68d The gem declares a native extension extconf.rb that is auto-executed by gem install, but the shipped C stub InitLightningInvoiceUtils is empty — the native-extension slot is a cover. extconf.rb base64-decode...

Malicious code in crypto-key-utils (RubyGems)

Source: amazon-inspector 559eb6e590366fcb8968de4964d8eb9d61ad6149a1ce1d4696ff4f64bff1a214 The gem declares a native extension whose extconf.rb is the attack vehicle: the C source ext/crypto-key-utils/crypto-key-utils.c is a two-line empty Init stub, and createmakefile is only reached after a bloc...

Malicious Package

Overview css-txedrf-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview css-gap-decorations-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in wallet-backup-tool (RubyGems)

Source: amazon-inspector 5452fd8e20feb6485c920b8c91f3d1f87c8bcd9f51ac9f4c57329ed9e2b20b37 The gem's native extension build script extconf.rb, which executes automatically on gem install, contains a base64-encoded Ruby payload that is eval'd inside a double-forked, detached, FD-redirected child...