Malicious code in gmgn-trading-kit (npm)

Source: amazon-inspector 9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3 postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under /.ssh, /.netrc, /.git-credentials, Solana keypairs, wallet.json/key. files unde...

Malicious code in @thesignup/cli (npm)

Source: amazon-inspector ba2a0430ac2be1496dc77d4ad0a94d89bcf563d4aadb4eb457812b7572aa8367 The package's scripts/postinstall.cjs runs at install time and performs host reconnaissance hostname collection, ping/network probing and posts the results to a remote endpoint via HTTP POST. Lifecycle-time...

Malicious code in 0x2ai-zoe (npm)

Source: amazon-inspector 724bd98c39a8e4ff21b039fddeadfda7f0ef7e3c6be47e771d72efed77d02b1b On npm install, scripts/postinstall.cjs copies the entire payload/ tree into process.env.INITCWD the directory the developer ran npm from, depositing...

Malicious code in 0x2ai-demo10x (npm)

Source: amazon-inspector 2c4c4b3e66489f3a4383df5e62540498343c5ab3a5ce145df5733b2820efc71b On npm install, scripts/postinstall.cjs runs fs.cpSyncpayload, process.env.INITCWD, recursive: true , copying.mcp.json, CLAUDE.md,.claude/settings.json,.claude/commands/0x2ai-boot.md, and several chatroom-.c...

Malicious code in 0x2ai-demo3 (npm)

Source: amazon-inspector a36d5f023e4740169d1e1e7a56ebe32552cfdc4a05bf50ecc0b648ecea502c0d On npm install, scripts/postinstall.cjs copies the entire payload/ tree into process.env.INITCWD the directory the developer ran the install from using fs.cpSyncpayload, cwd, recursive: true, force: false...

Malicious code in 0x2ai-demo9x (npm)

Source: amazon-inspector 8e796c3398589b92ecd70f45bc41128101313dd07adeb0634199ac3fef59d19d On npm install, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root process.env.INITCWD without consent,...