2921 matches found
Malicious code in xeprews (npm)
The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
Malicious code in react-nodejs (npm)
The package react-nodejs impersonates the legitimate 'react' package it republishes react's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
Malicious code in exprrdd (npm)
The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
Malicious code in express-javascript (npm)
The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
Malicious code in exprdd (npm)
The package exprdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
MAL-2026-17230 Malicious code in llm-nebula (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669 Package presents itself as an LLM SDK nebula.js exposes a small client stub but declares preinstall: node preinstall.cjs in package.json, and...
Malicious code in llm-nebula (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669 Package presents itself as an LLM SDK nebula.js exposes a small client stub but declares preinstall: node preinstall.cjs in package.json, and...
MAL-2026-17227 Malicious code in nebula-llm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...
Malicious code in nebula-llm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...
MAL-2026-17215 Malicious code in eslint-plugin-skywagon-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...
Malicious code in eslint-plugin-skywagon-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...
MAL-2026-17214 Malicious code in git-en-boite-logging (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ebee9f4428d7f14f6f941438064715c8bece34c5fe6bfedf32bbd8cba226c0 package.json declares a preinstall lifecycle hook that runs wget to a hardcoded webhook.site collector URL...
Malicious code in git-en-boite-logging (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ebee9f4428d7f14f6f941438064715c8bece34c5fe6bfedf32bbd8cba226c0 package.json declares a preinstall lifecycle hook that runs wget to a hardcoded webhook.site collector URL...
MAL-2026-17190 Malicious code in cma-self-hosted-sandbox-cf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d91a7568b717361d5b3727d46e8bf567fc038f95c5fa22c5222a272460bb9f35 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the machine's hostname, current user info, home director...
Malicious code in cma-self-hosted-sandbox-cf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d91a7568b717361d5b3727d46e8bf567fc038f95c5fa22c5222a272460bb9f35 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the machine's hostname, current user info, home director...
MAL-2026-16480 Malicious code in a-onesite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...
Malicious code in a-onesite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...
Malicious code in catqrcodeconverter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...
MAL-2026-16435 Malicious code in catqrcodeconverter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...