Malicious code in @medisend/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28 package.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname via $hostname as a query...

Malicious code in @medisend/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the...

MAL-2026-14421 Malicious code in @medisend/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the...

Malicious code in @medisend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...

MAL-2026-14422 Malicious code in @medisend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...

Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

MAL-2026-14432 Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

MAL-2026-14436 Malicious code in poly-price-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which...

Malicious code in auth-otp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script...

Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...

MAL-2026-14418 Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...

Malicious code in @medisend/webview-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf4b396c306b8f8d090b929c265b8ae848c75e53b9750d6f68800a4deefe9a2 package.json declares a postinstall lifecycle script that runs curl to https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with query parameter...

MAL-2026-14424 Malicious code in @medisend/webview-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf4b396c306b8f8d090b929c265b8ae848c75e53b9750d6f68800a4deefe9a2 package.json declares a postinstall lifecycle script that runs curl to https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with query parameter...

Malicious code in fuel-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...

MAL-2026-14355 Malicious code in fuel-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...

Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

MAL-2026-14379 Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

MAL-2026-14279 Malicious code in localize-translate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a4a3b42b13a5ba692edd9761c2d32d6682f555828df49cb44e40b623861a1f0 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, arch, node version, package name,...

Malicious code in localize-translate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a4a3b42b13a5ba692edd9761c2d32d6682f555828df49cb44e40b623861a1f0 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, arch, node version, package name,...

Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...