Malicious code in test1sdsd2 (npm)

Source: amazon-inspector 3c7bd7c5932337e17adaf4900cb7e29766fe6b5307bd170b38660dd05497ebdc Package [email protected] declares preinstall and postinstall hooks in package.json that execute index.js on npm install. index.js performs an HTTP GET to the hardcoded bare IP...

Malicious code in abu-common-components (npm)

Source: amazon-inspector 17e7b4ac8a492915d8475c73488b64236250746de410c705b7cc43c0656589be package.json declares preinstall and postinstall hooks that invoke curl against a hardcoded bare-IP HTTP endpoint http://64.227.183.144/depconf/abu-common-components/, sending the installer's username $whoam...

MAL-2026-10096 Malicious code in guest-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5244faa59fb08eaa6dec10250fe2218a4909cb06ecc6ac972fda38b144f2aaef Package publishes as version 99.0.0 under a name presented in its README as an unclaimed internal name, positioning it to win dependency-confusion...

Malicious code in module-index-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on npm install...

Malicious code in onboarding-respects-modal (npm)

onboarding-respects-modal is a dependency confusion proof-of-concept package published to the public npm registry by the account r0binak and self-labeled "Security research PoC - Dependency Confusion Hunter". It was published at the artificially high version 999.99.99, a floating-version bait use...

MAL-2026-5460 Malicious code in fhirproxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96e092973bad8e995bdec34000e45943e0be59996e84f181ee4bee9cd423f8eb [email protected] is a thin loader package whose only behavior is to pull and execute the dependency fhirproxy-utils. package.json declares both...

MSC-2026-5354

Mini Shai-Hulud supply chain attack: compromised npm and PyPI packages download and execute an obfuscated credential stealer execution.js via preinstall hooks that exfiltrates SSH keys, cloud credentials AWS, Azure, GCP, Kubernetes, CI/CD secrets, and environment variables through...

MSC-2026-5355

Mini Shai-Hulud supply chain attack: compromised npm and PyPI packages download and execute an obfuscated credential stealer execution.js via preinstall hooks that exfiltrates SSH keys, cloud credentials AWS, Azure, GCP, Kubernetes, CI/CD secrets, and environment variables through...

MSC-2026-5356

Mini Shai-Hulud supply chain attack: compromised npm and PyPI packages download and execute an obfuscated credential stealer execution.js via preinstall hooks that exfiltrates SSH keys, cloud credentials AWS, Azure, GCP, Kubernetes, CI/CD secrets, and environment variables through...

Malicious code in agents-a365-runtime (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...