CVE-2025-55349

CVE-2025-55349 — pm2 Arbitrary Code Execution via postinstall Discoverer : Golden Ticket Labs Vendor : Unitech pm2 Date Assigned : August 20, 2025 MITRE Description An issue in the lib/API/Modules/NPM.js component of Unitech PM2 v5.4.2 allows arbitrary code execution by installing packages with...

Malicious code in black-spindle-2 (npm)

Source: amazon-inspector 433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90 package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embedding a shell command-substitution expression in the URL path...

MAL-2026-18370 Malicious code in mw-communication-client (npm)

mw-communication-client was published to npm on 2026-10-27 from 06:55:13 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 10.0.0, 1.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

MAL-2026-18371 Malicious code in mw-test-utils (npm)

mw-test-utils was published to npm on 2026-10-27 from 06:56:36 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0, 10.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

MAL-2026-18369 Malicious code in mui-wrapper-x-date-pickers (npm)

mui-wrapper-x-date-pickers was published to npm on 2026-10-27 from 06:55:20 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in mw-communication-client (npm)

mw-communication-client was published to npm on 2026-10-27 from 06:55:13 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 10.0.0, 1.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environmen...

Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

Malicious code in mui-wrapper-x-date-pickers (npm)

mui-wrapper-x-date-pickers was published to npm on 2026-10-27 from 06:55:20 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in mw-test-utils (npm)

mw-test-utils was published to npm on 2026-10-27 from 06:56:36 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0, 10.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

MAL-2026-18372 Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environmen...

MAL-2026-18373 Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environmen...

Malicious code in csvflow-schema (npm)

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" index.js exports a small validateSchema function and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and...

Malicious code in @webapp-shared/login-vmok (npm)

@webapp-shared/login-vmok is a dependency-confusion package: it uses the @webapp-shared scope, which matches a private internal package scope, and was published on 2026-10-27 in versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0 and 99.0.1 so that builds resolving the internal name from the public regist...

MAL-2026-18368 Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and...

MAL-2026-18356 Malicious code in @webapp-shared/login-vmok (npm)

@webapp-shared/login-vmok is a dependency-confusion package: it uses the @webapp-shared scope, which matches a private internal package scope, and was published on 2026-10-27 in versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0 and 99.0.1 so that builds resolving the internal name from the public regist...