MAL-2026-15922 Malicious code in claude-channel-discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40db25d41cbf34007ee5be9e31462d8346c3ec51dcb5b72160e76739aaedf4ad [email protected] is a dependency-confusion probe. package.json declares preinstall and postinstall hooks node index.js --save-prod and a...

Malicious code in line-through (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname...

MAL-2026-15923 Malicious code in line-through (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname...

MAL-2026-15898 Malicious code in easypanel-ctl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7 On npm install, the preinstall lifecycle script collects installer host identity hostname, username, cwd and enumerates CI-related environment variab...

Malicious code in easypanel-ctl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7 On npm install, the preinstall lifecycle script collects installer host identity hostname, username, cwd and enumerates CI-related environment variab...

Malicious code in easypanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cb013a465c19126feba2006a81f33d65cc64b269e3da8ffe4e8284c7defa3cc easypanel-core ships an inert module.exports = main and places all functionality in a preinstall lifecycle script. On npm install, preinstall.js...

MAL-2026-15897 Malicious code in easypanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cb013a465c19126feba2006a81f33d65cc64b269e3da8ffe4e8284c7defa3cc easypanel-core ships an inert module.exports = main and places all functionality in a preinstall lifecycle script. On npm install, preinstall.js...

Malicious code in easypanel-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1675d70b09ce1f826b69fbfcee3cf56a81c49c37fa4fb4bdafd4f72b736880f8 The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable name...

MAL-2026-15896 Malicious code in easypanel-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1675d70b09ce1f826b69fbfcee3cf56a81c49c37fa4fb4bdafd4f72b736880f8 The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable name...

MAL-2026-15895 Malicious code in easypanel-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2744a6f0dfde1930ab560731e54cb8a1e1c8dc61a2072705498ddcaa6dd1a592 The package's preinstall lifecycle script runs automatically on npm install and collects installer identity os.hostname, os.userInfo.username,...

Malicious code in easypanel-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2744a6f0dfde1930ab560731e54cb8a1e1c8dc61a2072705498ddcaa6dd1a592 The package's preinstall lifecycle script runs automatically on npm install and collects installer identity os.hostname, os.userInfo.username,...

MAL-2026-15899 Malicious code in easypanel-docker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43ed7789fb269c2613ce7b2442fdceab1b5e8b5360048d7bda2a63f0e9fac63 The preinstall lifecycle script collects host fingerprint data os.hostname, os.userInfo.username, process.cwd, and CI-related environment variable...

Malicious code in easypanel-docker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43ed7789fb269c2613ce7b2442fdceab1b5e8b5360048d7bda2a63f0e9fac63 The preinstall lifecycle script collects host fingerprint data os.hostname, os.userInfo.username, process.cwd, and CI-related environment variable...

MAL-2026-15865 Malicious code in @avigilon/node-webrtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...

Malicious code in @avigilon/node-webrtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...

Malicious code in @quantixfinance/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...

MAL-2026-15850 Malicious code in @quantixfinance/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...

MAL-2026-15855 Malicious code in @quantixfinance/tron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf106f622a8d60232e7d296737eab7e44ffc42a598f40b4b2afea24aaa15f7c The package's declared preinstall script iterates process.env, filters keys against a broad credential/secret keyword list key, secret, token, pass,...

Malicious code in @quantixfinance/tron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf106f622a8d60232e7d296737eab7e44ffc42a598f40b4b2afea24aaa15f7c The package's declared preinstall script iterates process.env, filters keys against a broad credential/secret keyword list key, secret, token, pass,...

Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...