CVE-2024-34351

CVE-2024-34351 Test-bed for CVE-2024-34351: I used the latest vulnerable version of Next.js, which is 14.1.0. Set up the environment with the following command: npm install npm run dev...

Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

Malicious code in @angularr/router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83 The package.json preinstall script runs curl -L...

Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

MAL-2026-17495 Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

MAL-2026-17492 Malicious code in @angularr/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 122d8c8fdbfe9bd590dd3e1c41a6afcefff4f1c552af5f1756577975c84878a8 Package is published as @angularr/cli double 'r' and copies @angular/cli's description, keywords, homepage, repository URL, README, and version strin...

Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d06d6b516b21b0ac6ed45e5653dca243695a2c17326669ec58498e4c9bcf45 package.json declares the runtime dependency libsignal with the value github:chatunitycenter/libsignal-node, an off-registry git source with no commi...

Malicious code in @hrmony/kit-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5 The package's preinstall script and its main entry index.js both perform identical credential-harvesting: they query the EC2 Instance Metadata Servic...

mini-shai-hulud-scanner

Mini Shai-Hulud Scanner A free, offline scanner for the npm/PyPI supply chain worm that's currently chewing through major packages. Built by the Intrudify team. No signup, no telemetry, runs entirely offline. NHS CC-4781 · CVE-2026-45321 CVSS 9.6 · GHSA-g7cv-rxg3-hmpx What this is If you've run n...

Malicious code in express-javascript (npm)

The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in react-nodejs (npm)

The package react-nodejs impersonates the legitimate 'react' package it republishes react's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in @osl-design/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a3237fada0f96b2160cb8adea5c7734951ca960f71f3f4bf788fec9446b6d3b The package declares "install": "node index.js" in package.json, so npm install automatically executes its top-level script. That script loads...

Malicious code in @baanx/blockchain-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d The package runs a bootstrap from both its install lifecycle script node index.js and its main module that invokes an obfuscated probe. The probe rea...

MAL-2026-16155 Malicious code in ultra-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...

MAL-2026-15866 Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

MAL-2026-15565 Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

MAL-2026-15531 Malicious code in confluence-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7615f50c489336db7800ea3b79ef26a4e5af311f0484ee31871000e329c2813 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/confluence-editor rather than a semver range publish...

MAL-2026-15532 Malicious code in confluence-rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d314e75faa527b1c10dbc34b2867180fb0726f2547d9b0edd0564aec3e38fd8 package.json declares a self-referential dependency whose key equals the package's own name confluence-rest and whose value is the bare HTTPS URL...

Malicious code in paper-password-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a97853ce25938b0cc295a798fa8c9ae8ab513126e70b93084785636a91bc7ec4 package.json declares a dependency whose key equals the package's own name paper-password-input and whose value is a bare HTTPS URL,...