MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16117 Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16111 Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

MAL-2026-16112 Malicious code in etoro-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...

Malicious code in etoro-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...

Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

MAL-2026-16118 Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

Malicious code in etoro-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c The package's preinstall.js runs automatically on npm install and collects host identifiers os.hostname, os.userInfo.username, process.cwd,...

MAL-2026-16114 Malicious code in etoro-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c The package's preinstall.js runs automatically on npm install and collects host identifiers os.hostname, os.userInfo.username, process.cwd,...

MAL-2026-16071 Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

MAL-2026-16009 Malicious code in omni-channel-configurator-wireline-frontend (npm)

This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a copy of a private, internal package name. This is a dependency confusion attack. A build that gets the name from public npm installs this package in place of the real one. The...

MAL-2026-16008 Malicious code in b2b-frontend-external-library (npm)

This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a copy of a private, internal package name. This is a dependency confusion attack. A build that gets the name from public npm installs this package in place of the real one. The...

Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

MAL-2026-15561 Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

MAL-2026-15564 Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

MAL-2026-15553 Malicious code in es6-migrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8 The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields hostname, ...

Malicious code in es6-migrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8 The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields hostname, ...