Malicious code in rs-lookout-sandbox-poc (npm)

Source: amazon-inspector 4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c On module load, index.js reads os.userInfo.username and issues an HTTPS GET to a hardcoded third-party collector at https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, transmitting the installer's...

Malicious code in nwfp-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905a5825cb8abf7b385b98cfade02c315a4bc776bc37cfacd5ab20d5b8d03640 On require of nwfp-build-config, index.js loads lib/telemetry.js, which immediately runs an IIFE that reads the installer's hostname os.hostname and...

MAL-2026-18107 Malicious code in nwfp-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905a5825cb8abf7b385b98cfade02c315a4bc776bc37cfacd5ab20d5b8d03640 On require of nwfp-build-config, index.js loads lib/telemetry.js, which immediately runs an IIFE that reads the installer's hostname os.hostname and...

Malicious code in @birbalo/aliftech-ui (npm)

Source: amazon-inspector f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8 The npm package @birbalo/[email protected] ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the built-in os and https modules, reads os.hostname and...

Malicious code in @osl-design/react (npm)

Source: amazon-inspector 0a3237fada0f96b2160cb8adea5c7734951ca960f71f3f4bf788fec9446b6d3b The package declares "install": "node index.js" in package.json, so npm install automatically executes its top-level script. That script loads runtime/support/telemetry/probe/impl.js, which reads the...

MAL-2026-16378 Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

Malicious code in @baanx/blockchain-config (npm)

Source: amazon-inspector 0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d The package runs a bootstrap from both its install lifecycle script node index.js and its main module that invokes an obfuscated probe. The probe reads os.userInfo.username, os.hostname, and the basename of...

Malicious code in @baanx/solana-lib (npm)

Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That module reads the installer's username os.userInfo.usernam...

Malicious code in @shared-web/assets (npm)

Source: amazon-inspector e8fd9342e97dc9f655a994fe1091125f717cbfa7b89aa6a2333662ad23ad6771 The package runs an install lifecycle script node index.js and also executes ./lib/core.js on require. That code collects os.userInfo.username, os.hostname, and process.cwd and issues a DNS resolve4 for a...

Malicious code in upshift-finance (npm)

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...

Malicious code in augustdigital-sdk (npm)

augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package @augustdigital/sdk. Version 8.20.1 was copied verbatim from the genuine @augustdigital/[email protected] release published 2 hours earlier to masquerade as a legitimate mirror or...

Malicious code in gator-client (npm)

Source: amazon-inspector 1925735d02fb91f74a11718c3402ad0b10f551eecb8c6d88f02d475b3e0a799f On npm install via scripts.install: node index.js and on every require'gator-client', lib/core.js collects os.userInfo.username, os.hostname, and the basename of process.cwd, then issues a dns.resolve4 query...

Malicious code in @pluxee-connect/account-db-api-client (npm)

Source: amazon-inspector 49a36af66b1c55fbf7a78529c1fe2d15b819cef018300a03cdc8e0a1b59f36c9 Version 99.0.0 of this package targets an internal-looking npm scope and ships a postinstall.js that, on every npm install, reads os.hostname, os.userInfo.username, process.version, and the package name and...

Malicious code in myreviews-core (npm)

Source: amazon-inspector 9c41d5d4352e265f0efbc0089a19c5773ceeb76c0265831eeeeca19151fe4f64 package.json declares a postinstall lifecycle hook that runs node -e to issue an HTTPS GET to a hardcoded webhook.site collector URL, appending the installer's hostname os.hostname, OS username...