38993 matches found
Malicious code in continuing_cat_0xrequest (npm)
Source: amazon-inspector 821805ee45bf3d359026af97d394ee411fe0f886f404e94613c34780cdfd4485 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in continued_wildfowl_z3n (npm)
Source: amazon-inspector 564cbb256d9e9a2ffa1be03d4002eead0a5e4db894ec0ffafaa70a30961e0721 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in content_damselfly_replicate_automation (npm)
Source: amazon-inspector c4b43f8410ffed4469fed0d5723bf44bec72683d51219c176449c9d64b0489b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in consul-peerings (npm)
The package consul-peerings was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in contemporary_hamster_z3n (npm)
Source: amazon-inspector c5efc575e75600a1c2e263113fdb94bd9a4a94b3bfee7fe28a4ea5f8200ddf80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in contemporary-purple-fox (npm)
Source: amazon-inspector d42b6c00a6f2fa1c759808554b6744a14352c6e0eb128355bfe7af0fcf8a30b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in contemporary_ox_z3n (npm)
Source: amazon-inspector 474fc742c361afd723ea7433c639150ba63125b1087eaf2d2b23ce84bf96a35f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in consul-acls (npm)
The package consul-acls was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in consul-nspaces (npm)
--- Credit: OpenSSF source...
Malicious code in constitutional_tarantula_lavender-56 (npm)
Source: amazon-inspector 6ee29ff61dc16ad38cc6a060c3d1e2124d3b64f9913093282812e262acd36abe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in constant_spider_z3n (npm)
Source: amazon-inspector edf49ae05370ce2da89a275b32f5b0b7351b96990b001895ab719f77c398ff2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in constant_macaw_z3n (npm)
Source: amazon-inspector 0725501f3e91979ab36df1d5cb3254b650aa59ee63b5d72ed99fbc881932c287 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in constant_lobster-silentdev (npm)
Source: amazon-inspector f8c1bafa73faa8475bfcad96a2cee1729fced898e3248e75af69990aa9fb0235 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in constant_manatee_z3n (npm)
Source: amazon-inspector 10da022477c850a2e5144cb3f41b1afefd55bf46eae90d1b57854690dd6b01e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in consistent_carp_z3n (npm)
Source: amazon-inspector d2ef2214de84b1c3900d1cd0988c5c50611910f0a713ac16ef0131e5140a6906 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in console-webapp (npm)
--- Credit: OpenSSF source...
Malicious code in constant-chocolate-firefly (npm)
Source: amazon-inspector 1f562a79cd0253b53812371f27fdc20f9e007b04a03b1907f377e53c044e1080 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in conservative_whale_z3n (npm)
Source: amazon-inspector efc7d5d6833290d3ac823c13e21167524f926b3706062e416459df6479636ff7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in conservation_carp_z3n (npm)
Source: amazon-inspector fb4c3df2cd74aac08147b30d18a54f4c8488b2c0275169fb4aed48f0e04141d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in conservation_salmon_z3n (npm)
Source: amazon-inspector f950d8f99119a766b09e1e318fcae2fe031ca4fdeff4887fac52a15e388b7bca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in conservation_asp_z3n (npm)
Source: amazon-inspector 7c6be77398364989b9848d5a499f395148af75030b39542ca71a7394bc69bf4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in conscious-peach-finch (npm)
Source: amazon-inspector 200a135881159e16eb7972d175541fce5ef2aba01bc489e31d7d219e35b8dde5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in conscious_albatross_z3n (npm)
Source: amazon-inspector 06585bfb5643b844e1c07baaf8465847b3d37eed1a98da6e439f68561f92aade This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in congxinling-daoxibaode-liaoyu (npm)
The package congxinling-daoxibaode-liaoyu was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in confused_pike_z3n (npm)
Source: amazon-inspector 173972150fee0dae13490fcd5cefceda5cd6ac79e57e69d2cc5d9713c47d8fdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in confluent-examples-nodejs (npm)
The package confluent-examples-nodejs was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in confused_rooster_z3n (npm)
Source: amazon-inspector 872d0f6f58fb28a745e60715224f3bd2f27bd9f21cc276f7fd459369e4c88ac6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in configstore-quark-sync-callback (npm)
Source: amazon-inspector 30c3b67083ef101f23672989003756131308861e71de005811d2edde2b5f3f8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in configstore-enif-development-altair (npm)
Source: amazon-inspector 18867f5616affb9421d74ecd880425debcb7b7e0fc1670211003ddec8dc395d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in configstore-fusion-mensa-winston (npm)
Source: amazon-inspector 7480df2dc25d9a8f8ba0219587f72f5d1ac90ff210e0c0459f96e3fbbebb3052 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in config-cross-env-nova-bunyan (npm)
Source: amazon-inspector eec2e3c10bc0dfd078bb269217828be6878379754bbd7321847eb20ddb238aa4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in config-genomics-jekyll-ganymede (npm)
The package config-genomics-jekyll-ganymede was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in config-gridsome-rehype-io (npm)
Source: amazon-inspector ae3e9d295e11aba56fb8c1aa2464bdcc78ac712308ed1d341483477311ad06bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in confident_cow_z3n (npm)
Source: amazon-inspector a32a6a00ee3c7caf7849eda7327ea9b25ab23b3288ee465ec272f90cf32d5041 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in conduit-core (npm)
Source: amazon-inspector 81f9fa8b0c32901fb4a4b9bf52e4be69edec177320aea16a45dd777f792a8880 The package conduit-core was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in condemned_crawdad_z3n (npm)
Source: amazon-inspector 511e0e219c7bd38e27601b6dd316d19f7c2f9965cf155c163f8a2174f37e44fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in evilpostinstall (npm)
Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string via cut -b 2-4 and cut -b 5-. For version 4127000.0.1 the...
Malicious code in skxcmwuncbg2 (npm)
Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...
Malicious code in commonjs-code-token (npm)
Source: amazon-inspector c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad On npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned token field directly to eval. Whoever controls that endpoin...
Malicious code in ecobee2 (npm)
Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to http://169.58.96.170:9001/cb with the installer's os.hostname and the...
Malicious code in dpg-media-7ehemel (npm)
Source: ossf-package-analysis 77fbceeb8527e33ef6a3b68c9238f3a25b9ccaf8e2023b1e12b2a95e3a0f274e The OpenSSF Package Analysis project identified 'dpg-media-7ehemel' @ 999.9.15 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...
Malicious code in expect-dotenv (npm)
Source: amazon-inspector ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e The package's main entry runs a worker that performs an HTTPS GET to https://realase-0626.vercel.app/api/v1 and passes the response's parser string into vm.runInContext, then invokes the resulting function...
Malicious code in de-morgan (npm)
Source: amazon-inspector 93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f package.json declares both a dependencies and devDependencies entry for de-morgan pointing at http://pack.nppacks.com/npm/de-morgan, a non-npm-registry host reached over plain HTTP with no version pin or...
Malicious code in envpack-conf (npm)
Source: amazon-inspector a061ac72b9e392fee182ad4873aab0cc9a64694a11228438a7838343b96d338f envpack-conf 1.0.1 is a trojanized copy of the pkg-conf utility. index.js appends a top-level async IIFE that runs whenever the module is imported. The IIFE queries public Ethereum RPC endpoints...
Malicious code in dolyame-ui-tableinline (npm)
Source: amazon-inspector bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8 On require'dolyame-ui-tableinline', index.js loads init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors hostnames reconstructed at runtime via string-array.join"...
Malicious code in devplatform-stylelint-config (npm)
Source: amazon-inspector 0d5c417e542790e2e91860f8383960eecead75556b747c0fdc91227c3228f514 The package is published as 'devplatform-stylelint-config' with description 'environment config reader' and exposes a trivial ConfigLoader from index.js, but index.js also requires./setup.js which runs at...
Malicious code in dolyame-ui-cardlogo (npm)
Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via string-array concatenation oob-worker.cf99-9b3.workers.dev,...
Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)
Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reach multiple Cloudflare Workers subdomains, downloads an...
Malicious code in ded-pwa-test-pub-pkg (npm)
Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g. "oob-worker.cf1","00-416.w","orkers",".dev".join"" and additional .workers.dev variants plus a...
Malicious code in ded-pwa-bnpl-forms-test-demo (npm)
Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...