Malicious code in delivery-ci-core (npm)

Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in distributorblock (npm)

Source: amazon-inspector f8b9a4f0d7d51b904c51afac9543f8acc9e91d33277512dc9294a24e966903ea The package's main entry index.js re-exports a decoy telemetry module and unconditionally requires setup.js. On require, setup.js selects a platform-specific path, downloads an opaque binary from one of four...

Malicious code in ded-pwa-c-cms (npm)

Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from obfuscated author-controlled hosts Cloudflare Workers subdomain...

Malicious code in dolyame-ui-lazyrender (npm)

Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.de...

Malicious code in devplatform-react-mcp (npm)

Source: amazon-inspector 21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e [email protected] is a dropper disguised as a React MCP SDK. On require, index.js loads helpers.js which assembles three Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-ui-progresscircle (npm)

Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded Cloudflare workers.dev hosts oob-worker.cf100-416.workers.dev...

Malicious code in ded-pwa-c-page-maker-props (npm)

Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers hosts oob-worker.cf101/cf102/cf103-.workers.dev,...

Malicious code in delivery-ci-codeceptjs-fork (npm)

Source: amazon-inspector 5b04b71321d5c862e9bf8510e16b31cb4a78df5f06cd9c773265f7de475ebd06 On require of the package's main entry, runtime.js reconstructs attacker-controlled hostnames via Array.join string-splitting oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev,...

Malicious code in dbk-ui-forms (npm)

Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output of whoami/id/pwd/uname -a, and the names of process.env...

Malicious code in hdkey-wallet (npm)

Source: amazon-inspector 4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013 On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory, JSON-encodes and base64-wraps the payload, and transmits...

Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)

Source: amazon-inspector 8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3 dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from array-fragment string joins oob-worker.cf99-9b3.workers.dev...

Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)

Source: amazon-inspector 5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb The package's main entry index.js requires./compat, which at import time downloads a platform-specific executable from author-controlled endpoints assembled at runtime by joining string arrays:...

Malicious code in dolyame-boxy-independent-bnpl-text-block (npm)

Source: amazon-inspector 0d558b476b362ab912d18912a13c79e326b5fcdcdbe73b0f292d94aa89ac732d On require of the package, index.js loads runtime.js, which assembles Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev and...

Malicious code in dolyame-boxy-independent-bnpl-separator (npm)

Source: amazon-inspector 273880296b11c362e48b0d7b6d2795c56f8726937482462bee9e615943572d46 On load, index.js unconditionally requires platform.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf.workers.dev with fallbacks to sdk.dl.wel1.ru, pkg.dl.wel1.ru, ext.dl.wel1.ru,...

Malicious code in dolyame-boxy-independent-bnpl-documents (npm)

Source: amazon-inspector a1e1c76ea93bbc42ff9d45e1e876946d87d62dd9470683f34ffd312935b27802 On require of the package's main index.js, bridge.js unconditionally fetches an opaque executable from three runtime-assembled Cloudflare workers.dev hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-boxy-atom-container (npm)

Source: amazon-inspector 8fb29bd9c1d233b882994262382b5f0b5b21cb2b868c139720d5ec9533ce9301 On require of the package, index.js loads helpers.js which invokes setup at module load. setup selects a platform-specific payload path linux/darwin/win32, rotates through obfuscated Cloudflare Workers...

Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from string-split-obfuscated hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-zod-wip-api (npm)

Source: amazon-inspector 2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492 [email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally requires./vendor on load; vendor.js runs at module load, reassembles...

Malicious code in devplatform-utils (npm)

Source: amazon-inspector 0244bc7396ea5f52d909130a7d685fee98c0dda29cb18b82d17e8c9c90dff552 [email protected] ships an index.js whose main module requires bootstrap.js, which on load downloads a platform-specific binary payload from string-split-obfuscated Cloudflare Workers endpoints e.g...

Malicious code in harness-skil (npm)

Source: amazon-inspector e03ab8467953cd2233e07e792a33c7df7be2c99c66da3b814538a169337b93e6 The package's install.js wired to an npm install lifecycle hook requires childprocess, fs, and https, then issues an https.get to a raw.githubusercontent.com URL and writes/executes the fetched content with...

Malicious code in dot-utils-plus (npm)

Source: amazon-inspector 3091b9bb8cbf714d9391a59f7303a3748e183bbdf0fba2264b7496a2072e717f On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable VITEDOTUTILSAESSECRET, decrypts the result into JavaScript source, wraps it in a...

Malicious code in cwao-tools (npm)

Source: amazon-inspector 821b56cf14d7125df010804baf204325703e58d8f238fc0f219bf82652d99f31 package.json declares "preinstall": "./scripts/postbuild", and scripts/postbuild is a 976,568-byte stripped Linux x86 ELF sha256 36abd242…. The package advertises itself as a Node.js CosmWasm/AO contract...

Malicious code in defi-tools-39 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling c960+, byte-identical to swap-sdk-87. postinstall auto-execs, src/index.js harvests /.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env + seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894...

Malicious code in cryptodao-signer (npm)

Source: amazon-inspector dce8426b1d9dc5bde6547b58a21f2d3b519e56f7c2f948aa7e2173261532cee7 On npm install, the package's postinstall hook executes recon.js, which enumerates a hardcoded list of credential-bearing environment variables AWSSECRETACCESSKEY, NPMTOKEN, SSHPRIVATEKEY, MNEMONIC, GitLab...

Malicious code in custom-save-area-block (npm)

The npm package custom-save-area-block published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in documents-widgets (npm)

The npm package documents-widgets published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in jest-macos (npm)

The npm package jest-macos published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in delta-time-32bb (npm)

Source: amazon-inspector bcbd5b3b8f7702c8cf59c094e98f078f68563d407235bce1dd0ec6e6522fe03b Package declares a postinstall hook "postinstall": "node run.js" in package.json that executes run.js automatically on npm install. run.js imports os, fs, http, https, and childprocess and collects host...

Malicious code in hyperpure-core (npm)

Source: amazon-inspector 47dd43b980c7b5e3230ee57e6974d40804e54997ed88877ced301402dbcdef4c Package impersonates a Zomato internal namespace name hyperpure-core, repository URL pointing to github.com/zomato/hyperpure-core while shipping a 63-byte stub index.js that exports nothing functional. The...

Malicious code in executable-stories-formatters (npm)

Source: amazon-inspector abf4dee9166e156fd18cdc223be5d4da38eaa0eda8b28f6fde07190bc5244fd0 No concrete installer-harm indicators were identified in this version of the package. No lifecycle hooks, hardcoded network destinations, credential reads, or known dropper fingerprints surfaced during revie...

Malicious code in executable-stories-react (npm)

Source: amazon-inspector 763be018d834c8776be31ab5121b48eaf1172a0b48b933bc6b792484d2ac742a The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security a6c7977dbc054cdb7fe56da0d2fbd26e2a6fed695deb4263ccbf4adfedd86acb The...

Malicious code in executable-stories-init (npm)

Source: amazon-inspector cf8558677662bfcde2a5014a6ab8947b18228abb9415a5e41a964bcf5f5dd985 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security a6c7977dbc054cdb7fe56da0d2fbd26e2a6fed695deb4263ccbf4adfedd86acb The...

Malicious code in ict-ui-carbon (npm)

--- Credit: OpenSSF source...

Malicious code in ibotta-ts (npm)

--- Credit: OpenSSF source...

Malicious code in elf-stats-holly-bauble-986 (npm)

--- Credit: OpenSSF source...

Malicious code in dreactjs (npm)

--- Credit: OpenSSF source...

Malicious code in elf-stats-frosty-hammer-191 (npm)

--- Credit: OpenSSF source...

Malicious code in fmt-date-lite (npm)

Source: amazon-inspector 1c8dad7bd90f4cb0dbb1d4ce933bc39f04aefe4940a53605e5c3f30c48a313e4 On npm install, the package's postinstall lifecycle script runs the id command and transmits the resulting user/group identity to a hardcoded bare-IP endpoint at http://155.190.124.243:6788/ over plain HTTP...

Malicious code in home-mp-commons (npm)

Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single dependency 'ltidisafe' from a hardcoded off-registry URL ...

Malicious code in cppt-common (npm)

Source: amazon-inspector 484688d5963a9246f4fe7a2b5c1c7ebe6bba135a2a5df66b3ab57f44978407b2 [email protected] declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js collects host and user identifiers — os.hostname, os.userInfo, the output of whoam...

Malicious code in @biz44/id44-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malware in @merazmz/project-tracker

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in meraz-project-tracker

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in dilxztech

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in joko-klanting72-miaww (npm)

Source: amazon-inspector 03dba51cbf38ac8e5cbde1fbecfb2182204285b77564de32f21203dc936f9b5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-keripik42-sukiwir (npm)

Source: amazon-inspector 686965d4ac31e0459ce1da77046360254bb86ff96c7cc4bf0b3c8be413d55ffd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-keripik93-miaww (npm)

Source: amazon-inspector 63f09cec21d6c83dc64d31766d8244ced36913ed220157f1049b1a013f6e1973 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-keraktelor71-breki (npm)

Source: amazon-inspector 3ad81a2dad77d94554ed30c90f61ea55b60b677add416f64e83e7cd289a6a9f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-keripik82-riris (npm)

Source: amazon-inspector 86657c188ce9ec276a31daad0b83bc2b4d38212ffac70aacf9561456e10a82f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...