Malicious code in rs-lookout-sandbox-poc (npm)

Source: amazon-inspector 4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c On module load, index.js reads os.userInfo.username and issues an HTTPS GET to a hardcoded third-party collector at https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, transmitting the installer's...

Malicious code in nwfp-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905a5825cb8abf7b385b98cfade02c315a4bc776bc37cfacd5ab20d5b8d03640 On require of nwfp-build-config, index.js loads lib/telemetry.js, which immediately runs an IIFE that reads the installer's hostname os.hostname and...

MAL-2026-18107 Malicious code in nwfp-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905a5825cb8abf7b385b98cfade02c315a4bc776bc37cfacd5ab20d5b8d03640 On require of nwfp-build-config, index.js loads lib/telemetry.js, which immediately runs an IIFE that reads the installer's hostname os.hostname and...

Malicious code in @nf-addons/am-global-header (npm)

Source: amazon-inspector 5f4f7297a2ae76eee65506183462a7138df6115ee2bfad9c84878b7f3c7998c8 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo.username, os.hostname, and process.cwd, concatenates them with a...

Malicious code in @osl-design/react (npm)

Source: amazon-inspector 0a3237fada0f96b2160cb8adea5c7734951ca960f71f3f4bf788fec9446b6d3b The package declares "install": "node index.js" in package.json, so npm install automatically executes its top-level script. That script loads runtime/support/telemetry/probe/impl.js, which reads the...

Malicious code in @birbalo/aliftech-ui (npm)

Source: amazon-inspector f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8 The npm package @birbalo/[email protected] ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname and...

MAL-2026-16435 Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

Malicious code in @tvg-mar/promos-gtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...

MAL-2026-16413 Malicious code in @tvg-mar/promos-gtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...

MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

Malicious code in @user-services/web-components (npm)

Source: amazon-inspector 02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b @user-services/[email protected] fires a hidden telemetry probe on both the npm install lifecycle node index.js and on every require of the module. The probe in probe/impl.js reads os.userInfo.username,...

MAL-2026-16378 Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

Malicious code in @baanx/blockchain-config (npm)

Source: amazon-inspector 0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d The package runs a bootstrap from both its install lifecycle script node index.js and its main module that invokes an obfuscated probe. The probe reads os.userInfo.username, os.hostname, and the basename of...

Malicious code in @baanx/solana-lib (npm)

Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That module reads the installer's username os.userInfo.usernam...

Malicious code in @shared-web/assets (npm)

Source: amazon-inspector e8fd9342e97dc9f655a994fe1091125f717cbfa7b89aa6a2333662ad23ad6771 The package runs an install lifecycle script node index.js and also executes ./lib/core.js on require. That code collects os.userInfo.username, os.hostname, and process.cwd and issues a DNS resolve4 for a...

Malicious code in @tink/tink-link-core (npm)

Source: amazon-inspector 826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf The package impersonates the Tink open-banking SDK name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage github.com/tink-link/core but its actual behavior is host...

Malicious code in gs-uitk-testing-utils (npm)

Source: amazon-inspector 58475142ea32c554345513c67fd5ed8a8d6b60fb151e675249e4eb83984c8300 [email protected] declares an npm install lifecycle script scripts.install='node index.js' that loads lib/core.js. That module collects the installer's OS username os.userInfo.username, hostname...

Malicious code in @sarex-team/translator (npm)

Source: amazon-inspector 0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6 The package's install lifecycle script scripts.install="node index.js" automatically executes on npm install and loads lib/core.js. That module reads os.userInfo.username, os.hostname, and the basename of...

MAL-2026-14207 Malicious code in @sarex-team/viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5 The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded...

Malicious code in upshift-finance (npm)

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...