Malicious code in retracfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7656b934d52c542162613f35aa909400f46aa0dae186ef9d55667f048bdfdcd4 The npm package [email protected] ships with no documented functionality empty description, no README, no source, no dependencies and consists only of...

Malicious code in beaver-ui-icon-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc953ba45a243565fdc2ac41c733bfe5e4d09e9b9362325d2f670b39d1f84618 The package's postinstall script setup.js selects a platform-specific asset path and fetches an executable from a list of Cloudflare Workers subdomai...

MAL-2026-12144 Malicious code in beaver-ui-drawer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7ff4f4ef11d2ff4bbba6d98547a1f6c1e5834739b4943f581e057abb9e313ce [email protected] ships a postinstall script setup.js that assembles network destinations at runtime by joining split string fragments to hide...

MAL-2026-12206 Malicious code in simple-date-formatter-util-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28db20339e88b1f37da250a38c838eae62b32419a4c36e806b7c6367671f064c package.json declares a postinstall lifecycle script that runs curl against the hardcoded bare-IP endpoint http://124.221.154.135/pre, passing the...

Malicious code in simple-date-formatter-util-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28db20339e88b1f37da250a38c838eae62b32419a4c36e806b7c6367671f064c package.json declares a postinstall lifecycle script that runs curl against the hardcoded bare-IP endpoint http://124.221.154.135/pre, passing the...

MAL-2026-12205 Malicious code in simple-date-formatter-util-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ec6c790f702e0bb6617bb6bf16ad8b3a154bc7d539938535cde7a2cf205f17 The package's npm postinstall script curls cloud instance-metadata endpoints AWS 169.254.169.254, Alibaba 100.100.100.200, Tencent...

Malicious code in simple-date-formatter-util-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f8a19e2cff3bcaf070316f16650d8c1af6714f4c44db56971299ef01c16a25 Package advertises itself as a trivial date-formatting utility index.js exports a one-line formatDate wrapper but ships a package.json postinstall ho...

Malicious code in simple-date-formatter-util-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 043fc72acaebb0b8e96a80ee338611c81567284213ea047911a851d3f00dcc46 package.json declares a postinstall lifecycle script that runs a shell pipeline enumerating /home/work directory contents, probing the internal...

MAL-2026-12203 Malicious code in simple-date-formatter-util-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 043fc72acaebb0b8e96a80ee338611c81567284213ea047911a851d3f00dcc46 package.json declares a postinstall lifecycle script that runs a shell pipeline enumerating /home/work directory contents, probing the internal...

MAL-2026-12204 Malicious code in simple-date-formatter-util-16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d57172cd3c0a47afc03e1a15ca2ead758bb6f5c78a2234d42487d65cb4944c5 package.json declares a postinstall script that runs automatically on npm install. The script creates a block-device node for the host disk mknod...

MAL-2026-12197 Malicious code in simple-date-formatter-new-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6 package.json declares a postinstall script that runs a shell pipeline collecting host identifiers uname, id, routing and ARP tables, TCP-probe result...

MAL-2026-12198 Malicious code in simple-date-formatter-new-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a09ab26676285be9c12d5c7ecfef65a0f0ebf32cb0324a83d3249c28674a1824 Package is advertised as a date-formatting utility but its postinstall script probes an internal-range Kubernetes API 10.45.196.138:8080, endpoints...

MAL-2026-12199 Malicious code in simple-date-formatter-new-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f0bf9e4040cf2940b0ca9a9e5cea7def2c660925afd0ba959ed69d28ca007b7 The package.json postinstall script runs unconditionally on npm install, collecting host and internal-network reconnaissance kernel version via uname...

Malicious code in simple-date-formatter-new-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaef04a98dce874de04a92b580f4f919067a0e492d38dff69a57fc09db1cfe14 The package's postinstall script in package.json runs a shell pipeline that collects host and container-runtime information kernel version via uname...

Malicious code in @zzzgenesis00/env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfbfc9bcbea1e1b9d6c52e2585bf5b28064fe8e38fe53304450fe1fd19340f3b On npm install, postinstall.js reads installer-owned secret material — /.ssh entries, /.npmrc, /.gitconfig — and iterates a curated list of credentia...

Malicious code in @zzzgenesis00/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 742be73b4f635f669a2c8191ddc90c46150e9d92ca432e5045c570fc0163f439 @zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfiltrates them to...

Malicious code in @zzzgenesis00/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f75dc3a679eaa0579352bb4d345acb84247d70f4e4db06e5de04ff6d20f4e5 @zzzgenesis00/web3-utils-crypto ships a postinstall.js that runs automatically on npm install and harvests installer-side secrets and host data. The...

Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

MAL-2026-12122 Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

MAL-2026-12124 Malicious code in @zzzgenesis00/tronweb3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...