Malicious code in @zzzgenesis00/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 742be73b4f635f669a2c8191ddc90c46150e9d92ca432e5045c570fc0163f439 @zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfiltrates them to...

Malicious code in @zzzgenesis00/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f75dc3a679eaa0579352bb4d345acb84247d70f4e4db06e5de04ff6d20f4e5 @zzzgenesis00/web3-utils-crypto ships a postinstall.js that runs automatically on npm install and harvests installer-side secrets and host data. The...

MAL-2026-12125 Malicious code in @zzzgenesis00/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f75dc3a679eaa0579352bb4d345acb84247d70f4e4db06e5de04ff6d20f4e5 @zzzgenesis00/web3-utils-crypto ships a postinstall.js that runs automatically on npm install and harvests installer-side secrets and host data. The...

Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

MAL-2026-12122 Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

Malicious code in @zzzgenesis00/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd @zzzgenesis00/[email protected] impersonates the Solana SPL Token package and runs postinstall.js on npm install. The script harvests host...

MAL-2026-12123 Malicious code in @zzzgenesis00/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd @zzzgenesis00/[email protected] impersonates the Solana SPL Token package and runs postinstall.js on npm install. The script harvests host...

Malicious code in @zzzgenesis00/tronweb3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...

MAL-2026-12124 Malicious code in @zzzgenesis00/tronweb3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...

Malicious code in @zzzgenesis00/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcabff22bb09847474002e52ef9e8101a847fe662fcf18eec0617fd6e9829e20 This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious behavior is in postinstall.js,...

MAL-2026-12119 Malicious code in @zzzgenesis00/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcabff22bb09847474002e52ef9e8101a847fe662fcf18eec0617fd6e9829e20 This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious behavior is in postinstall.js,...

Malicious code in @zzzgenesis00/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1bce1ae0778169c4e5fb37721dfcc052c984efc60a257166adb4d20e2d39e5 @zzzgenesis00/hd-key-generator ships a postinstall.js that runs automatically on npm install. It enumerates /.ssh, /.npmrc, /.gitconfig, browser...

MAL-2026-12121 Malicious code in @zzzgenesis00/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1bce1ae0778169c4e5fb37721dfcc052c984efc60a257166adb4d20e2d39e5 @zzzgenesis00/hd-key-generator ships a postinstall.js that runs automatically on npm install. It enumerates /.ssh, /.npmrc, /.gitconfig, browser...

Malicious code in @wethenorth12/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8 @wethenorth12/[email protected] is a typosquat of the ethers package package name, description, and author string 'ricmoo' all mimic the real package;...

MAL-2026-12092 Malicious code in @wethenorth12/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8 @wethenorth12/[email protected] is a typosquat of the ethers package package name, description, and author string 'ricmoo' all mimic the real package;...

MAL-2026-12109 Malicious code in bip32-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115345055f99da651c7816286c6b076dbacdd2b659f466dded1a541b289e8c2d bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub module.exports = ; the package's only functional code i...

Malicious code in python-bitcoinlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...

MAL-2026-12113 Malicious code in python-bitcoinlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...

MAL-2026-12110 Malicious code in ethereum-sign-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6f2998ee6903e6a20b55e371b8b074fb130d3e4c6f6d489999fd61f7e536673 On npm install, the package's postinstall script node postinstall.js, declared in package.json scripts.postinstall reads installer-side secret files...

Malicious code in @zzzgenesis00/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8 On npm install, postinstall.js executes and enumerates installer-side secrets: files under /.ssh non-.pub private keys, /.npmrc, /.gitconfig,...