Malicious code in @corexium/xbails (npm)

Source: amazon-inspector 7e3ba0508c4009825b9eb3d248094ccbf28b2a2b4dcec420d1aaa533c1594729 package.json aliases the import name 'libsignal' to the third-party npm package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest' dist-tag: "libsignal": "npm:@bellaxchuu/libsignal-node@latest...

Malicious code in @goparrot-dashboard/payment (npm)

@goparrot-dashboard/payment is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0...

Malicious code in @goparrot-dashboard/franchise-directory (npm)

@goparrot-dashboard/franchise-directory is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/franchise-management (npm)

@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/homepages (npm)

@goparrot-dashboard/homepages is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/order (npm)

@goparrot-dashboard/order is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @atedone/workspace-context (npm)

Source: amazon-inspector 831ecc7c41217227ee159b85e4510e3d58c956be016bd7582e94fefb011565fe On require, the package's top-level state.initialize writes shell integration files into /.config/workspace-context init.zsh,.zshrc, session-runtime.js, presentation.js, channel.json and spawns a detached,...

Malicious code in @goparrot-dashboard/settings (npm)

@goparrot-dashboard/settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/combo-group (npm)

@goparrot-dashboard/combo-group is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard-api/users (npm)

@goparrot-dashboard-api/users is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Versi...

Malicious code in @goparrot-dashboard-api/orchestration (npm)

@goparrot-dashboard-api/orchestration is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same nam...

Malicious code in @goparrot-dashboard-api/store (npm)

@goparrot-dashboard-api/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Versi...

Malicious code in @goparrot-dashboard-api/shared (npm)

@goparrot-dashboard-api/shared is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/app (npm)

@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 ...

Malicious code in @goparrot-dashboard/category (npm)

@goparrot-dashboard/category is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in dopc-client (RubyGems)

Source: amazon-inspector 0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da On require 'dopc-client', lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require with query parameters carrying the installer's OS usernam...

Malicious code in @goparrot-dashboard-api/role-v2 (npm)

@goparrot-dashboard-api/role-v2 is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/analytics (npm)

@goparrot-dashboard/analytics is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/auth (npm)

@goparrot-dashboard/auth is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malware in paidwithtab

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in scdn-jquery

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in pyprig (PyPI)

Source: kam193 11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315 Clone of a legitimate Pydantic package with the added downloading of a remote code. The remote code is delivered from the GitHub repository and unpacked as a new module and then called during initialization of any...

Malicious code in @ifasn/mmdd-doc-mcp (npm)

Source: amazon-inspector 2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265 @ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup bin entry / npm start its index.js performs an unsolicited IMDSv2 handshake against the Alibaba Cloud ECS metada...

Malicious code in @ifasn/mmd-doc-mcp (npm)

Source: amazon-inspector e3b58b8adeff2784f4fdeb4bf0e873e5797893619b3bc36c55de55b85efca1b7 On startup, bin/main probes cloud instance-metadata endpoints for AWS including the IMDSv2 token path, GCP, Azure, and Alibaba including the RAM security-credentials/ role path under variables named...

Malicious code in @ifasn/md-doc-mcp (npm)

Source: amazon-inspector 808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb The package is advertised as a markdown toolkit MCP server TOC generation, word count, table formatting but on require of its main module and on startup of its md-doc-mcp bin it probes cloud-provider...

Malicious code in @ifasn/mdd-doc-mcp (npm)

Source: amazon-inspector 1d8295dd6d1f932aa9f2b865822f1a6f213e00fc288b35cd4b7d8fa0f07a8641 On load, index.js queries the Alibaba Cloud ECS instance metadata service at 100.100.100.200, performs the IMDSv2-style PUT to obtain a metadata token X-aliyun-ecs-metadata-token, then reads a base64-conceal...

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements for example DROP TABLE, which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root caus...

SD JWT JS: Tampered disclosures silently dropped instead of rejected

Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed sd array, @sd-jwt/decode 0.19.0 does not reject the presentation. It silently drops the unmatched Disclosure and returns a reduced claim set, reporting success. The Issuer signature...

Malware in bfvkjmeikpwhqxc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ms-client-portal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in internal-renderers

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in pandafortunerush

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in aytidaoffc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @maulenv/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in nachles

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @levvicode/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @levvicode/libsignal-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in justinofficial

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @levvicode/eslint-config

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in levvleys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-animatrix

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-animate-final

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-animate-engine

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-animate-test

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in unjailed

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @mrlegendbot/libsignal-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @mrlegendbot/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in wallet-adapter-base

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in sol-wallet-adapter

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in axelarjs-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...