Malicious code in dpg-media-7ehemel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594 npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment...

Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

MAL-2026-14361 Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

GO-2026-6213 vulnerabilities

Vulnerabilities for packages: flux, argo-cd, argo-events, external-secrets-operator, trufflehog, goreleaser, gptscript, snyk-cli, pulumi-language-dotnet, pulumi, witness, gomplate, guac, dagger, bom, grype, nfpm, trivy-operator, crossplane, kots, skaffold, cerbos, nuclei, zot, kubevela, gitaly,...

MAL-2026-14123 Malicious code in @oyo_tech/oyochat_user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e @oyotech/[email protected] is a dependency-confusion probe. package.json declares a preinstall script that runs node -e...

GHSA-HJCP-JMPX-G3QM vulnerabilities

Vulnerabilities for packages: thingsboard, cassandra-reaper, opensearch, cloudwatch-exporter, dependency-track, nrjmx, akhq, apicurio-registry, druid...

MAL-2026-14053 Malicious code in depcruise-baseline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c [email protected] has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as ...

GO-2024-2472 vulnerabilities

Vulnerabilities for packages: xeol, xeol-fips...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: linkerd-extension-init, buck2, wadm, sqlx, uv, lychee, rustup, wasm-pack, ztunnel-fips, rustls-ffi, parseable, linkerd2-proxy, zizmor, ztunnel, fnm, wash, zed, sccache, sdp-k8s-injector, nushell, rye, kdash, shadowsocks-rust, atuin, wasmtime, pixi, deno, oranda,...

GO-2025-3563 vulnerabilities

Vulnerabilities for packages: nri-f5, sealed-secrets, paranoia, snyk-cli, tekton-chains-fips, azcopy-fips, wireguard-go, cortex, age, argo-events-fips, minio-operator, kubernetes-dashboard-api-fips, falco-exporter-fips, prometheus-elasticsearch-exporter, argo-workflows, elvish, libnvidia-containe...

GO-2024-2472 vulnerabilities

Vulnerabilities for packages: xeol...

GO-2025-4014 vulnerabilities

Vulnerabilities for packages: sops, stern, kaf, spiffe-helper, rancher-system-agent, cadvisor, kubeflow, logstash-exporter, oras, nri-prometheus, dask-gateway, terraform-provider-azapi, whereabouts, wireguard-go, kustomize, shfmt, conftest, apisix-ingress-controller, kube-state-metrics,...

Malicious code in trezor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 744ba5806b927aefbdd505acb44fb77a23bb71570d27d1ba17ec7642dcf17383 [email protected] is a Trezor-lookalike npm package whose index.js, on first require, harvests installer-side secrets and posts them to a hardcoded...

Malicious code in hwi-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files...

Malicious code in ckcc-protocol (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebcdc07616ec6ab418a9005e1486d05f3753dc4d37f6ce61c5daed495d31e25 The npm package [email protected] typosquats the legitimate Coldcard ckcc-protocol tool and ships no functionality index.js exports . Its...

MAL-2026-11427 Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

Malicious code in test2221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...

Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

MAL-2026-11119 Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...