Malicious code in keroeltopgg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b4e331f9f02f436e01e5c7696088d12ea3237af7fbe54fd37ec37e786c960d [email protected] is a stub package whose index.js, executed on require/import, reads os.hostname and issues an HTTPS GET to the hardcoded collect...

Malicious code in wagmi-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...

Malicious code in viem-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32 The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey...

Malicious code in ccxt-trading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8 Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through...

MAL-2026-12109 Malicious code in bip32-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115345055f99da651c7816286c6b076dbacdd2b659f466dded1a541b289e8c2d bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub module.exports = ; the package's only functional code i...

Malicious code in ethereum-sign-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6f2998ee6903e6a20b55e371b8b074fb130d3e4c6f6d489999fd61f7e536673 On npm install, the package's postinstall script node postinstall.js, declared in package.json scripts.postinstall reads installer-side secret files...

MAL-2026-11135 Malicious code in ethers-secure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa36b9a8ec228142a26760738fbbca9c72f9634ed0abedb9d5beeae6a2441244 Package name mimics the popular ethers library. Its exported wallet API WalletClient/createWalletClient/parseAccount accepts an Ethereum private key...

Malicious code in trinity-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d576c0487668f599137a479e17ddc1335935fdec631f7d5adfa9e73049d7652 On npm install, the package's preinstall lifecycle reads a hex-encoded command string from preinstall.json, decodes it via Buffer.from..., 'hex', and...

MAL-2026-6467 Malicious code in @vpms/design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43ce5813fba2660b094a3e8a5c5a0bf2f1972530c294830c0a2e3d15dcd1b096 package.json declares preinstall="node index.js". On every npm install, index.js iterates process.env and harvests any variable whose name contains...

MAL-2026-10600 Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...