974 matches found
Malicious code in 2fasecretkey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...
MAL-2026-15548 Malicious code in 2fasecretkey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...
Malicious code in 2fa-secretkey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8458c66987512aafeb111d45ec4c5639bc5bb43cd342777b9972e727719fe2b7 The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdio-ignored child of the node...
MAL-2026-15547 Malicious code in 2fa-secretkey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8458c66987512aafeb111d45ec4c5639bc5bb43cd342777b9972e727719fe2b7 The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdio-ignored child of the node...
Malicious code in ecobee-home (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...
Malicious code in ecobee2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...
MAL-2026-14476 Malicious code in ecobee2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...
Malicious code in ecobee-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...
Malicious code in @medisend/shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28 package.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname via $hostname as a query...
MAL-2026-14423 Malicious code in @medisend/shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28 package.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname via $hostname as a query...
Malicious code in @medisend/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the...
MAL-2026-14421 Malicious code in @medisend/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the...
Malicious code in @medisend/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...
MAL-2026-14422 Malicious code in @medisend/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...
Malicious code in kelly-stake-sizing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...
MAL-2026-14432 Malicious code in kelly-stake-sizing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...
MAL-2026-14436 Malicious code in poly-price-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which...
Malicious code in auth-otp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script...
Malicious code in dotish (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...
MAL-2026-14418 Malicious code in dotish (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...