Malicious code in eslintcmd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf4500fbbfc85f42275772210ace6efb69c5f90d9d0a5edd7c0c75fa271f0c3 The package's postinstall script scripts/install-check.cjs fetches a JSON config from https://slimopump.vercel.app/config/clob-math.json, downloads...

Malicious Package

Overview @achuthvp/postinstall-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in ai-explain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2b6beb476c828df723da0a2b4b524cf671e2eed9223a6e04c45c0ec4d59172 [email protected] ships a postinstall hook dist/postinstall.js, mirrored from scripts/postinstall.js that, on npm install, collects the installer's OS...

Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

Malicious code in dayjscore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9b2226f2ebbeccf1bcafbec9c51e2b3f13e3a7712dfc22baa79fbb72393b8a The package's package.json declares scripts.postinstall = "node.init.js", causing.init.js to run automatically on npm install. The script harvests a...

MAL-2026-10587 Malicious code in dayjscore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9b2226f2ebbeccf1bcafbec9c51e2b3f13e3a7712dfc22baa79fbb72393b8a The package's package.json declares scripts.postinstall = "node.init.js", causing.init.js to run automatically on npm install. The script harvests a...

Malicious code in chalkdevx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates 65 credential and CI environment variables NPMTOKEN,...

MAL-2026-10584 Malicious code in chalkdevx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates 65 credential and CI environment variables NPMTOKEN,...

Malicious code in chalkdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619 chalkdev is a near-empty package index.js exports , 11-byte README whose sole runtime behavior is a postinstall hook that runs .init.js on npm instal...

MAL-2026-10583 Malicious code in chalkdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619 chalkdev is a near-empty package index.js exports , 11-byte README whose sole runtime behavior is a postinstall hook that runs .init.js on npm instal...

Malicious code in momenntjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aae445dd0b77bd7409820067097404e4ccb16d658e7911c7c4e659146fdfad4 momenntjs is a typosquat of momentjs whose package.json postinstall hook runs node.init.js. On npm install,.init.js enumerates roughly 60...

MAL-2026-10588 Malicious code in momenntjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aae445dd0b77bd7409820067097404e4ccb16d658e7911c7c4e659146fdfad4 momenntjs is a typosquat of momentjs whose package.json postinstall hook runs node.init.js. On npm install,.init.js enumerates roughly 60...

Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

MAL-2026-10594 Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

MAL-2026-10585 Malicious code in cheeriobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which...

Malicious code in cheeriobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which...

MAL-2026-10593 Malicious code in twiliobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a94eb66c6d3f03cf5b4e2e13527b9ab9bcb1ae85e75b62f79f58e225b941970 On npm install, [email protected] runs its declared postinstall script node.init.js, which enumerates credential-shaped environment variables NPMTOKEN,...

Malicious code in twiliobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a94eb66c6d3f03cf5b4e2e13527b9ab9bcb1ae85e75b62f79f58e225b941970 On npm install, [email protected] runs its declared postinstall script node.init.js, which enumerates credential-shaped environment variables NPMTOKEN,...

Malicious code in openaiwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...