Malicious code in @conduitops/logview-archive (npm)

Source: amazon-inspector f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009 On install, package.json's postinstall hook runs install.js, which invokes npm install @conduit/[email protected] --registry where the registry URL is stored as a base64+XOR-masked string in lib/toolchain.js...

Malicious code in @conduitops/logview-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009 On install, package.json's postinstall hook runs install.js, which invokes npm install @conduit/[email protected] --registry where the registry URL i...

Malicious code in @sudobility/wildduck_client (npm)

Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 URL amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

Malicious code in @sudobility/testomniac_client (npm)

Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com using an embedded A...

Malicious code in @sudobility/indexer_client (npm)

Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/ a presigned S3 URL embedding...

Malicious code in @sudobility/shaperouter_client (npm)

Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com using a presigned URL embedded AWS access key id ,...

MAL-2026-18129 Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...

Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...

MAL-2026-18127 Malicious code in @sudobility/indexer_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...

Malicious code in @sudobility/indexer_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...

MAL-2026-18130 Malicious code in @sudobility/wildduck_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 U...

Malicious code in @sudobility/wildduck_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 U...

MAL-2026-18128 Malicious code in @sudobility/shaperouter_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

Malicious code in @sudobility/shaperouter_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It collects os.hostname, the local username, platform/arch, Node...

MAL-2026-18105 Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It...

Malicious code in nitro-bundled-dep (npm)

Source: amazon-inspector 0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5 [email protected] ships a stub main module a Proxy that no-ops any property access plus beacon.cjs, which runs both from the postinstall lifecycle hook node beacon.cjs and on top-level require of...

Malicious code in orderly-plugin-liquidity-heatmap (npm)

orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs node ./scripts/setup.js on npm install. When the script detects GitHub Actions CI and GITHUBWORKSPACE set, it records the...

MAL-2026-17848 Malicious code in orderly-plugin-liquidity-heatmap (npm)

orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs node ./scripts/setup.js on npm install. When the script detects GitHub Actions CI and GITHUBWORKSPACE set, it records the...

MAL-2026-17571 Malicious code in @subql/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f636fe7b88ce4be7e029a7685f097fe9dc65090b919906ddf0368a3c07a3464a package.json declares a postinstall hook node./dist/project/readers/manifest-cache.js. That file embeds 60KB of base64 chunks under MANIFESTCACHESEED...