Malware in tostpro

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview tostpro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in tostpro (npm)

Source: amazon-inspector 2b31f6e946441400814984e1285717f9b2ee7fe5dacb7f0433f89396648a6183 The npm package [email protected] ships a preinstall lifecycle hook that invokes test.sh, which runs automatically on npm install. The script assembles the command curl and the data source env from single-lett...

MAL-2026-17564 Malicious code in tostpro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7785c0ac37ad4bb74abc644be2a5fc48bdb0d1248027e607fdf13ddaaa59d546 Package [email protected] declares scripts.preinstall='sh./rcepoc.sh'. On install, the shipped shell script runs id/hostname/pwd and appends a...

Malicious code in tostpro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7785c0ac37ad4bb74abc644be2a5fc48bdb0d1248027e607fdf13ddaaa59d546 Package [email protected] declares scripts.preinstall='sh./rcepoc.sh'. On install, the shipped shell script runs id/hostname/pwd and appends a...