Malware in @s4yhiitestpoc/r2-control

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/r2-dns

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/r2-echo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/scan-https-d

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/scan-echo-b

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/scan-control-a

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/scan-https-dualuse-e

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/r2-https-dualuse

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/scan-dns-c

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @s4yhiitestpoc/r2-https-b

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in monitoring-agent

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in zagents-message-bus (PyPI)

Source: kam193 0d1891d5d76adad51e120baa41752f0cc878b243eb400e7a12aba1616d31d1f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in nebulallm (PyPI)

Source: kam193 50e0ed125f08fd7743ccfb40590c24304b4731f6a99b69bc553b5bb8b7e57fc6 During installation package first downloads a JScript script, which then downloads the next malicious DLL. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in @capsense/core-ui (npm)

Source: ossf-package-analysis 8392b3f36f3576b4ce8308df7d98e3cfd6b68b6873116743a022c9940ee4515d The OpenSSF Package Analysis project identified '@capsense/core-ui' @ 99.99.100 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in event-bus-lite-testmetest (npm)

Source: amazon-inspector 038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721 The package ships a binding.gyp whose target has type "none" and no C/C++ source files; its only purpose is a GYP !... command-expansion that runs node index.js during the automatic node-gyp rebuild triggere...

Malicious code in @capsense/ccx-welcome-page (npm)

Source: ossf-package-analysis 08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2 The OpenSSF Package Analysis project identified '@capsense/ccx-welcome-page' @ 99.99.100 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malware in w-mousekey

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @ppa-web-components/ppa-headerfooter (npm)

Source: amazon-inspector 32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce The package ships a beacon.cjs script wired as both the postinstall lifecycle hook node beacon.cjs and a require-time side effect from index.js. On install and on require, the beacon POSTs installer...

Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

Source: amazon-inspector e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e @ppa-web-components/[email protected] is a stub package whose only functional code is a callback beacon. The package.json declares scripts.postinstall: "node beacon.cjs", and the same beacon.cjs is...

Malicious code in jshelperdependenceny (npm)

Source: amazon-inspector dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9 npm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 package of the same name — the classic dependency-confusion shap...

Malicious code in @ppa-web-components/ppa-searchform (npm)

Source: amazon-inspector c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c The package ships a beacon.cjs that is wired to run both via the postinstall lifecycle script and from top-level index.js on require. On execution it collects host identifiers hostname, install path, current...

Malicious code in react-native-bright-sdk (npm)

Source: amazon-inspector 4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55 The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname and an install timestamp, base64-encodes the JSON payload, and transmits it via HTTPS...

Malicious code in sc-hydrate-carousel-price (npm)

Source: amazon-inspector fbcb760747e0ad33cc6bafa85914d99b141f5361c13c5c642122d1ea8f973d9f package.json declares a dependency ltidisafe whose source is a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.3.tgz rather than a registry version range. On npm install,...

Malicious code in @ppa-web-components/ppa-builder (npm)

Source: amazon-inspector cc4615498b50aa4b5f39a8367c44e6a18d4a7272ae71235716a152b2933d5ddd The package is described as a 'Compatibility shim' and ships a stub Proxy-based main plus beacon.cjs. The package.json declares scripts.postinstall: 'node beacon.cjs', and the main entry also invokes the sam...

Malicious code in paychex-pdftron (npm)

Source: amazon-inspector d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3 [email protected] ships an empty stub module.exports = and declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.5.tgz rather th...

Malicious code in @ppa-web-components/ppa-banner (npm)

Source: amazon-inspector bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d @ppa-web-components/[email protected] is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and beacon.cjs. beacon.cjs defines BEACON =...

Malicious code in @ppa-web-components/ppa-navigation (npm)

Source: amazon-inspector c88c344e72bb7cf5ae6f5e6185a1024caf8b96bce96584d448609ab78cd894af The package is a shim whose only functional payload is a beacon. package.json declares a postinstall that runs node beacon.cjs, and index.js additionally invokes require'./beacon.cjs'.fire on load, so the...

Malicious code in @postex/common (npm)

Source: amazon-inspector 2fb98ad3575267cc8fbf617fe6a17000ed10df97d39710f4b7aaddf7225598d7 @postex/[email protected] ships an inert index.js module.exports = and declares a single dependency ltidisafe whose value is a bare HTTPS tarball URL...

Malicious code in @futurae-public/adaptive-js (npm)

Source: amazon-inspector 18526e44113025f1e08a31eb237515c63ae912a6cfe82bec37c14895f4f23178 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.2.tgz rather than a registry version range. On npm install, npm...

Malicious code in @greenlake/session (npm)

Source: amazon-inspector 3255cc4148a62c7ba090d1912d41c572f3ce7ccb6db9cc131132cfd4a0970f43 The package is a scoped-namespace shim version 99.0.1 whose main entry re-exports a Proxy returning no-op functions, allowing consumer builds to resolve this name without errors. On npm install postinstall...

Malicious code in @factoryz/apollo (npm)

Source: amazon-inspector 5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad The package ships only an empty stub module.exports = and a manifest whose sole dependency ltidisafe is resolved from a hardcoded off-registry HTTPS URL...

Malicious code in @jm-telefonica/multibrand-components (npm)

Source: amazon-inspector 7ef565c5fd4b4baa7e0bff888cf34107fa8a9385932195fa4fd90ad39f250927 package.json at line 9 declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.4.tgz rather than a registry version range. On npm...

Malicious code in @fmr-ap153177/apex-kit-icons (npm)

Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz instead of a registry version range. On npm install, npm...

Malicious code in @generic-means/ing-feat-scanner-libs (npm)

Source: amazon-inspector 7053eaf141232704108519a3b3e7a0f1197d9eaabfa9fd3f4ff56ae9f753d763 package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.3.tgz rather than a registry version range or a git ref pinned to ...

Malicious code in @greenlake/common-context (npm)

Source: amazon-inspector 5c391fc0f0acc51479adc96cdca5e63497f47dd4304eb0a871819bce9313551e @greenlake/[email protected] is a stub package whose main entry exports a Proxy of no-op functions and whose only real behavior is a beacon. Both scripts.postinstall node beacon.cjs and require of the ma...

Malicious code in @drone-js-ext/core (npm)

Source: amazon-inspector 9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43 The package ships a beacon.cjs that collects host identifiers hostname, install path, current working directory, Node version and POSTs them in cleartext to the hardcoded bare-IP endpoint...

Malicious code in @drone-js-ext/vip-badge (npm)

Source: amazon-inspector 2f7afa65da63d3360d15659ebdcce5f5078fa7bd210e04c069f88834f0c1f75c The package is a zero-functionality stub whose main module index.js exports a Proxy returning no-op functions for any property access. Its only real behavior is a beacon implemented in beacon.cjs that collec...

Malicious code in fontus (PyPI)

Source: kam193 2a8fcff0fd4d827c6f174318ee41ea82eb2667c6d65349a01ca2215aa2f4dd5e The package most likely performs fingerprinting by exfiltrating basic information and available fonts, with no other functionality. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but...

Malware in insta-reel-search

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tiktok-video-scraper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ionic-tiktok-scraper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in insta-api-wrapper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in sound-cloud-loader-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ionic-sound-cloud-loader-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ocsp-hashes

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in youtube-search-without-api-key

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in youtube-info-streams

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ionic-insta-api-wrapper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in appit-cordova-plugin-ionic

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in redis-dumper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...