Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

MAL-2026-11128 Malicious code in app-soda-layer (npm)

app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...