95594 matches found
Malicious code in happy-dlscord.js (npm)
Source: amazon-inspector 2d183bf51c0f2be0102a7a7aeeda661f895e3b075f183d76d5f0f77c09c70860 The package name 'happy-dlscord.js' is a one-character edit of the top-tier npm package 'discord.js' and ships a near-verbatim fork of the upstream library with an injected payload in src/client/Client.js. I...
Malicious code in n8n-nodes-whatsapp-business-api-by-automations-builder (npm)
Source: amazon-inspector a012be4fda5d6832fa3f4b404fd0026c0b351642260408e7f4fbb955e48b38a8 Package presents itself as an n8n node for the WhatsApp Business API Meta Graph. Instead of calling graph.facebook.com, every request β credential validation, sendMessage, fetchMessageTemplates β is routed t...
Malicious code in fulcrum-sessions (npm)
Source: amazon-inspector f3971399e0fb1bd6c61f5306557512ed22dc0605747526b600b08626a50eb31e src/config.js hardcodes a live Telegram bot token bot id 8656735452 and a default groupId -1003974755050 pointing at a chat owned by the package author. getConfig falls back to these defaults when the...
Malicious code in autoheal-dev-cli (npm)
Source: amazon-inspector 6e0f114cd638df1be1f2262e1b05dbe726cee5600a10be6d67be8ac8e1089f3d autoheal-dev-cli is a setup wizard bin/setup.js that, when run, performs three installer-harm actions against the developer running it: 1 syncConfigToServer POSTs the user's GitHub Personal Access Token with...
Malicious code in @kruzer/lib-ui (npm)
Source: amazon-inspector c1bb1f66615de2b0b161721218d2bff4bb0e7100b5cb28b764fcc2e6f1ee671f The published tarball's package.json contains a hardcoded npm registry auth token embedded in the build:publish script: npm publish --tag alpha...
Malicious code in @autoheal/setup (npm)
Source: amazon-inspector 3a8b8b7d51e8865d048583893b08ad3d3d95a8371963b82adc6bf4b7938fe4c1 When the user runs this setup wizard, bin/setup.js posts the user's GitHub Personal Access Token scope repo,user:email, GitHub repo name, branch, Vercel deploy hook, and N8N webhook URL to a hardcoded...
Malicious code in @agora-sdk/react-js (npm)
Source: amazon-inspector 9febb9d8dda2eea07ef909b9713ca6531c4a5b51a75fd730a312bec8d8a11135 Package is published under the '@agora-sdk' scope, strongly associated with Agora.io's real-time-communications SDKs, but its actual contents are a fork of @replyke/react-js exports ReplykeProvider,...
Malicious code in token-me-uk (npm)
Source: amazon-inspector 2a058b653e7a491fdf0c9128b4d2d408c2cdac6a1784adc5f02a0975a0e669eb The CLI in cli.mjs reads its API key from process.env.TOKENMEUKAPIKEY, falling back to process.env.OPENAIAPIKEY and then process.env.ANTHROPICAPIKEY cli.mjs:7, and sends whichever value is found as a Bearer...
Malicious code in @kmmao/happy-coder (npm)
Source: amazon-inspector c4478b22a21a87a37250e86ef25639330f79b779e5793f642eaf7ddaafd975d4 This package is a near-verbatim fork of the upstream happy-coder/happy-cli references to slopus/happy-cli and happy.engineering are retained throughout the bundle and README, repackaged under the @kmmao scop...
Malicious code in 0x2ai-demo8x (npm)
Source: amazon-inspector f6d1ce2d7b8faa5bde122eb2bc6e0a79fec5f5720cfa7de0718a0c8948b344d6 On npm install, scripts/postinstall.cjs copies the package's payload/ tree into INITCWD the consumer's project root using fs.cpSync, dropping.mcp.json,.claude/settings.json, CLAUDE.md, and several chatroom-...
Malicious code in conversa-sdk (npm)
Source: amazon-inspector baaff1de63d44fd5f6b4fb1c5d3ebb4e9509d7581ff9afa5f339acad8f57aed0 On npm install, postinstall.js unconditionally reads the installer's /.npmrc which typically contains //registry.npmjs.org/:authToken=... along with the OS username, hostname, node version, and platform, and...
Malicious code in create-cf-token (npm)
Source: amazon-inspector 56d9884f6d63e063d1320b8d8efbfb8852f00bd3c18c87b03b445f6978897570 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security a6c7977dbc054cdb7fe56da0d2fbd26e2a6fed695deb4263ccbf4adfedd86acb The...
Malicious code in generate-iam-token (npm)
--- Credit: OpenSSF source...
Malicious code in fiat-token-admin (npm)
--- Credit: OpenSSF source...
Malicious code in token-prices-cron (npm)
Source: amazon-inspector 10adc862166a2dbaf26f3dc56b4c1dfa0fd45e625f713380564d0b18fb07088d On npm install, the preinstall lifecycle script in postinstall.js enumerates process.env, filters keys matching a broad credential regex...
Malicious code in @public-for-cdao/token (npm)
Source: amazon-inspector eb59d96acba76c5d5e2044eae3d7dfeb33bc19f10d75aa04fcf6765ad9b7fde8 Package @public-for-cdao/[email protected] is a dependency-confusion payload targeting an internal @cdao/token scope. package.json declares a postinstall hook that runs node recon.js, which on npm install...
Malicious Package
Overview @public-for-cdao/token is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
CVE-2026-65616
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...
CVE-2026-42016
JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the tokenβs scope...
CVE-2026-65616 Potential privilege escalation to JFrog administrator privileges
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...