sish

sish Open source SSH tunneling for HTTPS, WSS, TCP, aliases, and SNI. If you like the simplicity of serveo/ngrok-style sharing but want to use plain SSH and run your own infrastructure, sish is built for that. No custom client required for end users Public and private tunnel workflows Docker and...

MAL-2026-12125 Malicious code in @zzzgenesis00/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f75dc3a679eaa0579352bb4d345acb84247d70f4e4db06e5de04ff6d20f4e5 @zzzgenesis00/web3-utils-crypto ships a postinstall.js that runs automatically on npm install and harvests installer-side secrets and host data. The...

Malicious code in @zzzgenesis00/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f75dc3a679eaa0579352bb4d345acb84247d70f4e4db06e5de04ff6d20f4e5 @zzzgenesis00/web3-utils-crypto ships a postinstall.js that runs automatically on npm install and harvests installer-side secrets and host data. The...

Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

MAL-2026-12122 Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

MAL-2026-12123 Malicious code in @zzzgenesis00/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd @zzzgenesis00/[email protected] impersonates the Solana SPL Token package and runs postinstall.js on npm install. The script harvests host...

Malicious code in @zzzgenesis00/tronweb3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...

MAL-2026-12124 Malicious code in @zzzgenesis00/tronweb3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...

MAL-2026-12119 Malicious code in @zzzgenesis00/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcabff22bb09847474002e52ef9e8101a847fe662fcf18eec0617fd6e9829e20 This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious behavior is in postinstall.js,...

Malicious code in @zzzgenesis00/docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2417f0620e130c16865914c5f79fdff63bdda0daf3257955c8fd536ab894c1b1 postinstall.js runs automatically on npm install and enumerates installer-side secret stores including /.ssh, /.npmrc, /.gitconfig, Chrome and Firefo...

MAL-2026-12055 Malicious code in @zzzgenesis00/docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2417f0620e130c16865914c5f79fdff63bdda0daf3257955c8fd536ab894c1b1 postinstall.js runs automatically on npm install and enumerates installer-side secret stores including /.ssh, /.npmrc, /.gitconfig, Chrome and Firefo...

Malicious code in @zzzgenesis00/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28a7a4b265a274814769439b7bcc3e03e573308ac72036558815feabfec0c8af The package @zzzgenesis00/playwrite is a typosquat of playwright. Its exported launch returns empty stub methods, while postinstall.js also loaded...

MAL-2026-12031 Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

MAL-2026-11533 Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

Malicious code in @zzzgenesis00/solana-wallet-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46 The postinstall.js script, which runs automatically on npm install, harvests a broad set of installer-owned secrets and identity data and exfiltrates...

Malicious code in exodus-checkout-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 921c5ef246587db452bdb65aae12321f4de868e7882f9550f9b9e32300ae792c exodus-checkout-signer is the unscoped name of the scoped package @exodus/checkout-signer and self-describes in README and package.json as a...

Malicious code in grateful-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2a9600ad3ee3fddd9f06425260c94edf660263800080787155a63d3e5212d12 On npm install, the postinstall hook in src/canary.js performs a DNS lookup and an HTTPS GET to a serveo tunnel host...

MAL-2026-5436 Malicious code in checkout-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6add4dfcaaf79ce107ac8026032b47540def183a121be2266891644c90f10c8 Package replicates the API surface of an internal Exodus package generateMnemonicSigningKeys, signDirectPaymentMultiChain, signCapture, signRefund,...

Malicious code in checkout-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6add4dfcaaf79ce107ac8026032b47540def183a121be2266891644c90f10c8 Package replicates the API surface of an internal Exodus package generateMnemonicSigningKeys, signDirectPaymentMultiChain, signCapture, signRefund,...