Malicious code in eslint-rxjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2794273ee7e40da4b37c017636209acf1402b1104ab5fc265a43cc7d83228e72 eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate...

MAL-2026-15812 Malicious code in eslint-rxjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2794273ee7e40da4b37c017636209acf1402b1104ab5fc265a43cc7d83228e72 eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate...

allstar v4.6

Allstar !IMPORTANT The OpenSSF-hosted Allstar GitHub App has been retired. Allstar, the OpenSSF Scorecard subproject, itself continues to be maintained — you must now run it yourself, either as a GitHub Action or as a service daemon. See ossf/allstar881 for more details. If your organization was...

Malicious code in verify-contract-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7cfabb396e93e034caeb560ea029e3ca2bde784b8c713d5f8941a2b621dd36 The package ships a single bin entry bin/cli.js that, when invoked, runs whoami and POSTs the package name, username, hostname, and platform to a...

MAL-2026-15599 Malicious code in verify-contract-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1037ebeeb5eff8da3b46c8275a09151604157ddc24db244d76d27d97bfdddad bin/cli.js executes whoami and reads os.hostname / os.userInfo / os.platform, then POSTs those values to the hardcoded endpoint...

Malicious code in com.db.autobahn.notification-center-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae376efc666d8e07f356f9f3cbafe2dfc99e221a150ff96548db4a2b91bb452 package.json declares preinstall and postinstall lifecycle scripts that automatically run curl on npm install to send installer identity whoami,...

MAL-2026-15589 Malicious code in autobahn-electron-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9a749e23bbf7c5ca871c797923855dc2c7fe1006c5843ed8a13292d7fbd4256 package.json declares preinstall and postinstall lifecycle scripts that run curl against...

Malicious code in autobahn-electron-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9a749e23bbf7c5ca871c797923855dc2c7fe1006c5843ed8a13292d7fbd4256 package.json declares preinstall and postinstall lifecycle scripts that run curl against...

Nest v2026.08.24

!Issueshttps://img.shields.io/github/issues/owasp/nest?color=blue&style=...

Malicious code in omniauth-recharge-rails-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27ec72eac9d0bae686eddce65991c912a23c97621648e3316cd05188038d17d7 The package's package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL...

MAL-2026-14443 Malicious code in @elc-online/up-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e659619abda05c9d3835997471d962784e947fd65960e24146082b596d015d6e The OpenSSF Package Analysis project identified '@elc-online/up-analytics' @ 99.99.99 npm as malicious. It is considered malicious because: - Th...

Malicious code in @elc-online/up-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e659619abda05c9d3835997471d962784e947fd65960e24146082b596d015d6e The OpenSSF Package Analysis project identified '@elc-online/up-analytics' @ 99.99.99 npm as malicious. It is considered malicious because: - Th...

MAL-2026-14411 Malicious code in dpg-media-7ehemel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594 npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment...

Malicious code in dpg-media-7ehemel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594 npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment...

Malicious code in msrcpoc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 57de2918e25798c84b17d6a743fbadb99a5e564b8ea34e1ab5d4a0ff6d509df0 The OpenSSF Package Analysis project identified 'msrcpoc' @ 99.1.9 pypi as malicious. It is considered malicious because: - The package executes...

Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

MAL-2026-14387 Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

Malicious code in fund-portfolio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27ba065e8759299d381ed1c7abd5e7721037b4ea969a384a9e70cfb6bb799e17 Package declares scripts.preinstall: node index.js, causing index.js to run automatically on npm install. The script collects hostname, username, hom...

MAL-2026-14361 Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...