CVE-2024-34351

CVE-2024-34351 Test-bed for CVE-2024-34351: I used the latest vulnerable version of Next.js, which is 14.1.0. Set up the environment with the following command: npm install npm run dev...

mini-shai-hulud-scanner

Mini Shai-Hulud Scanner A free, offline scanner for the npm/PyPI supply chain worm that's currently chewing through major packages. Built by the Intrudify team. No signup, no telemetry, runs entirely offline. NHS CC-4781 · CVE-2026-45321 CVSS 9.6 · GHSA-g7cv-rxg3-hmpx What this is If you've run n...

Malicious code in @fmr-ap153177/apex-kit-icons (npm)

Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz instead of a registry version range. On npm install, npm...

Malicious code in @drone-js-ext/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43 The package ships a beacon.cjs that collects host identifiers hostname, install path, current working directory, Node version and POSTs them in...

Malicious code in react-native-bright-sdk (npm)

react-native-bright-sdk 9000.0.0 is a dependency-confusion package that squats the name of a React Native SDK that is distributed privately as a tarball outside the npm registry. Its preinstall script runs node canary.js, which collects the machine's hostname and a timestamp, base64-encodes them...

Malicious code in test-brotli-testmetest (npm)

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

Malicious code in test-brotli2-testmetest (npm)

test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in test-brotli2-testmetest (npm)

test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in test-brotli-testmetest (npm)

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in data-pipeline-testmetest (npm)

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun downloaded from GitHub...

Malicious code in @coopeuch/components (npm)

Source: amazon-inspector 042f083be94ae23751c73b5a73c0f11e4e9ecafd9ee9f1caa8c05b367ac71de8 The package declares a postinstall script postinstall.js that runs automatically on npm install and collects a broad set of installer-side identifiers: hostname, username, uid/gid, home directory, platform,...

MAL-2026-17763 Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

MAL-2026-17772 Malicious code in liferay-workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...

Malicious code in liferay-workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...

Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

Source: amazon-inspector fb9736fcd5112c468c10509da5d624384a70802de5e20b218ad2cbebe0c7a443 The package declares scripts.preinstall node index.js || true, and index.js also the main entry requires a platform-specific prebuilt native addon at prebuilds/-/metrics.node. The native binary reads a curat...

Malicious code in @dransay/db (npm)

Source: amazon-inspector dc3d55a63787b5f45312d0b8433f6e782b2a6b28e89ef6377e24e5d26c757a61 On npm install, the package's preinstall hook executes beacon.js, which performs a DNS lookup and HTTPS GET to a hardcoded interactsh OAST subdomain under oast.site, embedding the package name in the path. T...

MAL-2026-17693 Malicious code in @bitwardne/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7d0b3168a3a56cb6208688970e6109a964ccfb99a97fe7061d57e007b67ca6 package.json declares a preinstall lifecycle script of the form 'curl -L | node', which fetches remote content and executes it in Node at npm install...

MAL-2026-17696 Malicious code in @dransay/feature-flags (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the...