Malicious code in line-through (npm)

Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname, and GitHub Actions / CI environment variables CI,...

Malicious code in message-compiler (npm)

Source: amazon-inspector f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417 The package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via api.ipify.org, reads CI-related environment variables CI,...

Malicious code in fastly-vcl-language-client (npm)

Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via api.ipify.org, reads os.hostname, and collects CI runner...

Malicious code in fkext-browser-min (npm)

Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects os.hostname and GitHub Actions / CI environment variables...