CVE-2025-55349

CVE-2025-55349 — pm2 通过 postinstall 的任意代码执行 发现者 : Golden Ticket Labs 供应商 : Unitech pm2 分配日期 : 2025年8月20日 MITRE 描述 Unitech PM2 v5.4.2 中 lib/API/Modules/NPM.js 组件的一个问题允许通过安装带有精心构造的 postinstall 脚本的包来执行任意代码。 PM2 在从基于 Git 或本地文件安装中调用时，会自动运行 postinstall 生命周期脚本，而无需沙箱或用户确认，包括通过以下方式调用时：...

Malicious code in @umschool/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...

MAL-2026-16051 Malicious code in @umschool/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...

Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

MAL-2026-15871 Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

MAL-2026-15824 Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

Malicious code in @stellarshift/chain-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...

MAL-2026-15821 Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

MAL-2026-15822 Malicious code in @stellarshift/chain-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...

Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

Malicious code in cminhouse-api-gateway-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...

MAL-2026-15816 Malicious code in order-package-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb09ffe18928cf319d13dc52111750c394330d53b38b4d8814b0d2372471308e The package's postinstall hook executes index.js, which sweeps installer-owned secrets from the home directory...

Malicious code in order-package-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb09ffe18928cf319d13dc52111750c394330d53b38b4d8814b0d2372471308e The package's postinstall hook executes index.js, which sweeps installer-owned secrets from the home directory...

Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

MAL-2026-15813 Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

Malicious code in evilpostinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...