Malware in contracts-upgradeable

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @bigdevin55/calculator-install-demo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in calculator-preinstall-chain-demo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in calculator-preinstall-hook-demo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @bigdevin55/calculator-install-hook

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @nuxzofficial/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in nuxzofficial

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwindcss-animate-bridge

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @utilitycraft/tailwindcss-motion-atelier

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in atlassian-wallboard-plugin1

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in claims-ac1

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in atlassian-wallboard-plugin

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in shoaib-unity (RubyGems)

Source: ossf-package-analysis ba322db91ecd6b863e8b06aa24b804a27f29cf2c8e2954bc1e77d7dc45e2fd52 The OpenSSF Package Analysis project identified 'shoaib-unity' @ 1.0.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

Source: ossf-package-analysis f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain...

Malware in persona-ai-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in wallet-tracking (PyPI)

Malicious package. wallet-tracking is a PyPI cryptocurrency-wallet information stealer. It collects wallet data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. The source also still contains an unconfigured placeholder webhook URL .../api/webhooks/YOURURL beside t...

Malicious code in litecore-lib-ltc (npm)

Malicious package. litecore-lib-ltc is a typosquat of the legitimate litecore-lib Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API api.blockcypher.com to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to a...

Malicious code in self-v8 (npm)

Malicious package. self-v8 is an npm package that harvests sensitive data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicator...

Malicious code in @notrainer/nobtrainer-sdk (npm)

Malicious package. @notrainer/nobtrainer-sdk is an npm package that exfiltrates sensitive data on the victim host to an attacker-controlled Discord webhook. The same Discord webhook endpoint ID 1433690093175967776 is also used by the npm package @johnruff215-dev/solana-wallet-tracker, indicating...

Malicious code in sol-wallet-adapter (npm)

sol-wallet-adapter takes the unscoped name of @project-serum/sol-wallet-adapter and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in claims-ac1 (npm)

claims-ac1 1.0.0 contains only a package.json declaring a single dependency, node-ac2, that is not fetched from the npm registry but from a tarball in the GitHub repository GamerD11/pingtest https://github.com/GamerD11/pingtest/raw/main/node-ac2.tgz. That tarball has no code and in turn depends o...

Malicious code in contracts-upgradeable (npm)

contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in dependencykfee-2 (npm)

Source: ossf-package-analysis bb75f6ebc23c1e1ea6fc3ae422db80b65e8f9b8d7c21faa2de9c58ba049e9d89 The OpenSSF Package Analysis project identified 'dependencykfee-2' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in @mobile-platform/magnetic-components (npm)

@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves @mobile-platform from npm runs its code instead of...

Malicious code in bigbob22-test (npm)

[email protected] has no functional code and an empty README. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in zystcdemo (npm)

zystcdemo presents itself as a simple date formatting utility and runs its postinstall payload on npm install with node postinstall.js. The payload collects the whoami result, hostname, platform, and current time, then sends them in a POST request to https://srctest.zystcc.cn/collect; npm account...

Malicious code in ms-client-portal (npm)

ms-client-portal is a dependency-confusion package with no functional code; its README says the name is an internal project name exposed in the production web bundle of a health-sector client portal. Its preinstall and postinstall scripts each run a node -e one-liner on npm install that sends an...

Malicious code in axelarjs-sdk (npm)

[email protected] takes the unscoped name of @axelar-network/axelarjs-sdk and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in cutekitten-test (npm)

[email protected] describes itself as a security test package for a school project and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in scdn-jquery (npm)

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads https://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to...

Malicious code in calculator-preinstall-hook-demo (npm)

[email protected] presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook...

Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)

Malicious package. @johnruff215-dev/solana-wallet-tracker is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint ID 1433690093175967776 is also used by the npm package...

Malicious code in wallet-adapter-base (npm)

wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in calculator-preinstall-chain-demo (npm)

[email protected] has no install script of its own but depends on exactly [email protected], so npm install runs that package's preinstall script node preinstall.js. The script POSTs the machine's hostname and the OS username to the Discord webhook...

Malicious code in @axo_cuy/baileys (npm)

Source: amazon-inspector 0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48 package.json declares a hard dependency libsignal with the source github:tenka-san/libsignal-node. This is an off-registry dependency source: npm install resolves it to the current HEAD of that third-party...

Malicious code in @bil-rgb/baileys (npm)

Source: amazon-inspector 3bcbf6493a6aa37ccc827723d6fd73b082c66d10a549af2413aba2a8a6f47b7f package.json for @bil-rgb/[email protected] declares its libsignal dependency as github:tenka-san/libsignal-node with no commit SHA, no tag, and no integrity check. npm install resolves this value by cloning...

Malicious code in @an1mshnpmb9c84920/pipeprobe-obf-m19n5 (npm)

Source: amazon-inspector 66025f4cca9a4269af1b3b1278d850c9454b62d8e9ec90ad6e4ba8ac73c0fce2 The package's prepare lifecycle script executes node index.js, which reconstructs the hostname npmp19n5--768.oob.awss.dev by joining a string array and issues a DNS lookup via require'dns'.lookup.... The...

Malware in dsh-screenshot-native

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in atlassian-wallboard-plugin (npm)

Source: ossf-package-analysis 65fa335403aab4ce396a9df1a2b0d61634f51ee8d63db761c0ccf21f744b6292 The OpenSSF Package Analysis project identified 'atlassian-wallboard-plugin' @ 10.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in macs-shoaibs-pro17 (RubyGems)

Source: ossf-package-analysis b839ba696947a26e059bc82d4feb35120e11ff4885ff5bc5da19d9800f51f837 The OpenSSF Package Analysis project identified 'macs-shoaibs-pro17' @ 90002.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain associated with malicio...

Malicious code in privacypass-py (PyPI)

Source: amazon-inspector 0ca6e88317dac5ec524d2dc6ec4b2af7934e2213569ed7c8a757e59edb45b0c3 The package presents itself as 'Privacy Pass client primitives' but ships no cryptographic functionality. Its only runtime effect is a data-exfiltration beacon. setup.py invokes a report routine during...

Malicious code in @axon-web/icons (npm)

Source: amazon-inspector 579025dc4de76ecd9400215e99d550cb4579ab6eb7d78e4c3c91a2299ff59c91 On require, index.js constructs an identifier from os.hostname and process.env.USER/USERNAME and issues a DNS resolve against a subdomain of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun — an interactsh/OAST...

Malicious code in hs-framework (npm)

Source: amazon-inspector 2950f0dff0145db43d5dd123c45c2786c7d42f58e7dec69e0178ca2aa325c478 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz instead of a registry version range. On npm install, npm fetche...

Malicious code in pystr-codec (PyPI)

Source: kam193 9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1 Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting...

Malware in @mamans2973/maman

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in skills-analyzer (PyPI)

Source: kam193 415c95c384a9901bda7b98bdcf86142c041e21de2759e7048769a49bf54d9bea In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency is-it-ai, intentionally pinned by specific versions of...

Malicious code in multi-convert (PyPI)

Source: kam193 63d1834ac673303487e7c46affaf2be63ac0b142aaab8e79027144aad9cbd9de In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency is-it-ai, intentionally pinned by specific versions of...

Malicious code in doctreelstm (PyPI)

Source: kam193 9609b278449fb9d196f4929f422f22288aa202df7b8417d91053ab0180711bb8 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in md-to-slides (PyPI)

Source: kam193 b11c84f48dc5185cf83056d55f0b2fa64fa415afae3f258baa5887c1ce44bc7c In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency is-it-ai, intentionally pinned by specific versions of...

Malicious code in is-it-ai (PyPI)

Source: kam193 6a8580750a7d490d65866e9407c451efa8dbad9a90c35a54b87416c57eef1fea In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency is-it-ai, intentionally pinned by specific versions of...