Malicious code in axios-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e [email protected] declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installi...

MAL-2026-14029 Malicious code in axios-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e [email protected] declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installi...

MAL-2026-14021 Malicious code in alelo-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e The package's preinstall script preinstall.js collects hostname, username, platform, current working directory, and the full process.env, then POSTs...

Malicious code in alelo-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e The package's preinstall script preinstall.js collects hostname, username, platform, current working directory, and the full process.env, then POSTs...

MAL-2026-14020 Malicious code in alelo-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e520850363c3164a09e0772022283849a0abd1b6f60e9168f4a5fd3ff338886 The package fires attacker-controlled code on npm install via both preinstall.js and index.js postinstall. preinstall.js collects hostname, username,...

Malicious code in alelo-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e520850363c3164a09e0772022283849a0abd1b6f60e9168f4a5fd3ff338886 The package fires attacker-controlled code on npm install via both preinstall.js and index.js postinstall. preinstall.js collects hostname, username,...

Malicious code in alelo-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1e53c8bced61d4dfbd9121821219a5c35f2a7f273f06e9e2cfd628f509341f The package auto-executes exfiltration code during npm install via preinstall and postinstall lifecycle scripts. preinstall.js collects the hostname,...

MAL-2026-14023 Malicious code in alelo-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1e53c8bced61d4dfbd9121821219a5c35f2a7f273f06e9e2cfd628f509341f The package auto-executes exfiltration code during npm install via preinstall and postinstall lifecycle scripts. preinstall.js collects the hostname,...

Malicious code in meualelo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fdf84c3f49f6d13b7ccbed745056f8bf03c4c7a2b814152962361ac07bd4191 The package's preinstall.js collects hostname, username, platform, cwd, and the full process.env, then POSTs the JSON payload over HTTPS with TLS...

MAL-2026-14027 Malicious code in alelo-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31cdc535ad02d3d78533315ef2037d4860699d9c7a161ed96a176082824f07 [email protected] runs both preinstall and postinstall lifecycle scripts that harvest installer data and POST it to the hardcoded bare-IP endpoin...

Malicious code in alelo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898fc8ceef98678ef5e208de13006abf0684d219babdee50f6f90b732092f8b [email protected] is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace version 99.0.0, generic 'internal...

MAL-2026-14022 Malicious code in alelo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898fc8ceef98678ef5e208de13006abf0684d219babdee50f6f90b732092f8b [email protected] is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace version 99.0.0, generic 'internal...

MAL-2026-14016 Malicious code in preinstall-hook-webhook-callback-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1 package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an...

Malicious code in preinstall-hook-webhook-callback-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1 package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an...

Malicious code in notafollower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768 [email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. T...

MAL-2026-13986 Malicious code in notafollower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768 [email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. T...

Malicious code in @khaznatech/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59ac302f60b532a4e864c576593db300a20abba96ae2a53ba5da0cc06d8dc911 The package's preinstall script install-report.js runs automatically on npm install and performs an HTTPS GET to a hardcoded webhook.site capture...

MAL-2026-13973 Malicious code in @khaznatech/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59ac302f60b532a4e864c576593db300a20abba96ae2a53ba5da0cc06d8dc911 The package's preinstall script install-report.js runs automatically on npm install and performs an HTTPS GET to a hardcoded webhook.site capture...

Malicious code in @khaznatech/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d6d321090b3f66b7766ca73a5cebf1a2d3ab2908d8d31f8423616c8094ec0a8 The package declares a preinstall script install-report.js that runs on npm install. It reads os.hostname and the current working directory basename...

MAL-2026-13975 Malicious code in @khaznatech/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d6d321090b3f66b7766ca73a5cebf1a2d3ab2908d8d31f8423616c8094ec0a8 The package declares a preinstall script install-report.js that runs on npm install. It reads os.hostname and the current working directory basename...