Malicious code in xcryption (npm)

Source: amazon-inspector 989e6d862a8e433df7f0bd31ab9a6b76f616273783517c81f5e428ad2774ad4e The package declares a postinstall script scripts/install.js that on npm install downloads a ZIP archive from https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip, writes it to a randomized...

Malicious code in @noobaihome/amis-uni-area-widget (npm)

Source: amazon-inspector 1741a7c8b780801766382499022f9aa860eb8313e4a416a5157afeb9a92f6561 scripts/install.js runs during npm preinstall and performs three attacker-beneficial actions against the installer host. First, it unconditionally beacons installer identifiers pid, base64-encoded process.cw...

Malicious code in @noobaihome/amis-simple-area-widget (npm)

Source: amazon-inspector 642f206459c4677892954c26736b990c72bb01ae9383f917ab664b38d977819f @noobaihome/[email protected] advertises an AI Suda amis area-chart widget, but dist/renderer.umd.js and dist/plugin.umd.js are empty stubs module.exports = . The only functional code is...