Malicious code in mtslink-depconf-probe-profileusername (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f679922753b7a59c59af851ae74275b5d4760b13fc516bc8c68e8e9568393dc6 Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.c...

Malicious code in optimizely-starter-kit-for-fastly-compute (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...

Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

Malicious code in alelo-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e The package's preinstall script preinstall.js collects hostname, username, platform, current working directory, and the full process.env, then POSTs...

MAL-2026-14021 Malicious code in alelo-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e The package's preinstall script preinstall.js collects hostname, username, platform, current working directory, and the full process.env, then POSTs...

Malicious code in alelo-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1e53c8bced61d4dfbd9121821219a5c35f2a7f273f06e9e2cfd628f509341f The package auto-executes exfiltration code during npm install via preinstall and postinstall lifecycle scripts. preinstall.js collects the hostname,...

MAL-2026-14027 Malicious code in alelo-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31cdc535ad02d3d78533315ef2037d4860699d9c7a161ed96a176082824f07 [email protected] runs both preinstall and postinstall lifecycle scripts that harvest installer data and POST it to the hardcoded bare-IP endpoin...

MAL-2026-14022 Malicious code in alelo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898fc8ceef98678ef5e208de13006abf0684d219babdee50f6f90b732092f8b [email protected] is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace version 99.0.0, generic 'internal...

Malicious code in ai-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...

MAL-2026-13934 Malicious code in ai-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...

Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

MAL-2026-13448 Malicious code in lib-frontsga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a65c44cfdcbc89df47508f3f87fcab836f1fa2f4adf2298ecfb47cd6088038 Package name 'lib-frontsga' published to the public npm registry at version 9.999.999 targets an internal package name via dependency-confusion...

MAL-2026-13467 Malicious code in wos-library-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3124274f6fcb74cf0805b5545f6952214b90329427f55c616c868f760d592e63 [email protected] declares scripts.preinstall = 'node poc.js', which auto-runs on npm install. poc.js reads os.hostname, os.userInfo.username, an...

MAL-2026-13436 Malicious code in @wbnr/frontend-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username...

Malicious code in cewe-npm-cops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 673bd57ca8632e768772381c7439b0b15008914879dfb5c22d42e40ce954c9e5 [email protected] is a dependency-confusion probe. package.json declares scripts.preinstall = 'node preinstall.js'; preinstall.js reads os.hostnam...

MAL-2026-13438 Malicious code in cewe-npm-cops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 673bd57ca8632e768772381c7439b0b15008914879dfb5c22d42e40ce954c9e5 [email protected] is a dependency-confusion probe. package.json declares scripts.preinstall = 'node preinstall.js'; preinstall.js reads os.hostnam...

Malicious code in glia-functions-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f6c700225d22dcccdf1af7bb58c7628366ccc59b864431af5123909b42626 package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current working directory, reads...

MAL-2026-12809 Malicious code in technical-challenge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6921f72a1b4fbaaba87fcbe3cb30137815e7e2bb932ffa794acd0010b8954c5f package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects installer-side data —...

MAL-2026-12794 Malicious code in karapace-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686 The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home directory, DNS server list,...

Malicious code in voicemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...