Malicious code in @greenlake/context-pane (npm)

@greenlake/context-pane is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.0 has a postinstall script that runs node beacon.cjs on npm instal...

Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

Malicious code in @greenlake/auth (npm)

@greenlake/auth is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0 has a postinstall script that runs node beacon.cjs on npm install, and index.js...