Malicious code in @stellarshift/chain-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...

Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

MAL-2026-15818 Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

MAL-2026-15815 Malicious code in cminhouse-api-gateway-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...

Malicious code in cminhouse-api-gateway-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...

Malicious code in test__123q2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386 On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an...

MAL-2026-15638 Malicious code in test__123q2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386 On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an...

MAL-2026-15632 Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

MAL-2026-15565 Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

MAL-2026-15551 Malicious code in date-fns-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967 package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to...

Malicious code in date-fns-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967 package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to...

Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

Malicious code in 2fasecretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...

MAL-2026-15548 Malicious code in 2fasecretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...

MAL-2026-15547 Malicious code in 2fa-secretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8458c66987512aafeb111d45ec4c5639bc5bb43cd342777b9972e727719fe2b7 The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdio-ignored child of the node...

Malicious code in 2fa-secretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8458c66987512aafeb111d45ec4c5639bc5bb43cd342777b9972e727719fe2b7 The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdio-ignored child of the node...

Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...