Malicious code in memories-core-web (npm)

Source: amazon-inspector 5aa2bc32ff519468287f8a87deeff1349332b710735b9f78ee34ffd46c9511cb package.json declares a preinstall lifecycle script that runs curl to a hardcoded webhook.site collector URL https://webhook.site/b2967b0a-1b24-4670-8ae1-e09e3cf272c4/ with the installer's hostname and...

MAL-2026-18106 Malicious code in memories-core-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5aa2bc32ff519468287f8a87deeff1349332b710735b9f78ee34ffd46c9511cb package.json declares a preinstall lifecycle script that runs curl to a hardcoded webhook.site collector URL...

Malicious code in react-paginate-v5 (npm)

Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an implausibly high version 99.0.0 to win resolution against an...

MAL-2026-17777 Malicious code in react-paginate-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an...

Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

Source: amazon-inspector 524c80bfea6a1b22cb0a4784d2763ccf83099faab3816c9fcb1ce39bb8813152 On npm install, this package runs node index.js || true as a preinstall script. index.js loads a platform-specific native addon from prebuilds/-/metrics.node. The Linux and Windows binaries contain the...

Malicious code in @brick-v2/icons (npm)

Source: amazon-inspector 915977ddb276c313e2977875d853dfba4eebd12f75ad0826008866b5059c68a8 @brick-v2/[email protected] is a dependency-confusion credential stealer. The package's package.json declares a preinstall script node index.js, and index.js's only behavior is to require a platform-specific...

MAL-2026-17717 Malicious code in @brick-v2/icons (npm)

@brick-v2/icons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...

MAL-2026-17730 Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

@galicia-toolkit-nestjs-20-lite/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...

Malicious code in @brick-v2/icons (npm)

@brick-v2/icons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

MAL-2026-17728 Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...

Malicious code in @dransay/secrets (npm)

Source: amazon-inspector aef0f6b36413e45664391c5341f7c30a4501c2cc916add9ba6525bf57e559d51 The package declares a preinstall script that runs beacon.js, which performs a DNS lookup and HTTPS GET to a hardcoded Interactsh collector host db3klhbi6i9hark1kegg174t38h33b6wt.oast.site at npm install tim...

Malicious code in @dransay/phone-fix-test (npm)

Source: amazon-inspector e01479e9a6af5de5f6abec6c16007bd3757b52b0e434b38b44d40fde12961c08 Package.json declares scripts.preinstall="node beacon.js", which fires automatically on npm install. beacon.js performs a DNS lookup and HTTPS GET to a hardcoded Interactsh/OAST subdomain under oast.site,...

Malicious code in dransay (npm)

Source: amazon-inspector 46d06d0ce82913346840f676660d67f9838f48511e58eef793bfe7c52091071f [email protected] declares a preinstall lifecycle script that runs node beacon.js, which performs a DNS lookup and HTTPS GET against a hardcoded Interactsh oast.site collaborator subdomain...

MAL-2026-17694 Malicious code in @bitwardne/jslib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d Package @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form cu...

MAL-2026-17693 Malicious code in @bitwardne/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7d0b3168a3a56cb6208688970e6109a964ccfb99a97fe7061d57e007b67ca6 package.json declares a preinstall lifecycle script of the form 'curl -L | node', which fetches remote content and executes it in Node at npm install...

MAL-2026-17700 Malicious code in dransay (npm)

[email protected] is a dependency-confusion probe for an internal unscoped dransay package name, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using dransay-unscoped ...

MAL-2026-17698 Malicious code in @dransay/phone-fix-test (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the...

Malicious code in @dransay/phone-fix-test (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the...

MAL-2026-17699 Malicious code in @dransay/secrets (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package...