Malicious code in cookie-parseflow (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zzjinavcsbzr (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in mailconfirmer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfb184ffa15fd011b84658a6b5cd68582e78827258a8373f0da1ef34248bfb09 The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log demo messages. The real...

Malicious code in @403name/ether-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927758f43d6eaa6514273bd8ab8f3559624055b9bbf8c9ef9a190b645c0a6eef On require'@403name/ether-js', index.js runs an IIFE that targets macOS only returns early on non-darwin and when CI/GITHUBACTIONS env vars are set,...

Malicious code in check-error-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c25cbbb904c18028cac363ba66eb89d91301bd3204a8347834e52387b4b575e On require/import, index.js executes a top-level resolveConfig that reconstructs a URL from an XOR-obfuscated integer array, AES-256-CBC-decrypts it,...

Malicious code in mcp-server-sequential-thinking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 211672c16839ae6cd4e9f10810163da536480f07938b2d51c50ecbbb9f5e90ed Unscoped package impersonating the official @modelcontextprotocol/server-sequential-thinking MCP server. package.json declares postinstall: 'node...

Malicious code in funcdesc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5756a79331cdda67721e39889609f5c0b5e342b678dbce2de97c94ec2dbe29 The package installs funcdesc-setup.pth, which Python auto-executes at interpreter startup for any environment where this package is installed. The.p...

Malicious code in create-wrangler-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3bd71e3d5a93887188f34c9434d24b09d1108a2471ab437d6e78ae216162b05 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sf-silly-goose-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d1b2d16ce881d1e9b356ed424f8144ce9324d09010efa8761ad13ac8a46e7b60 Package uses trufflehog to detect secrets and exfiltrates them to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, lik...

Malicious code in @redhat-cloud-services/vulnerabilities-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Malicious code in cms-storehub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dda5fa0b4771a3299568c8dd8d17d5663d9c8ae782b8c71f4a2baf0ce1f8e5ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cloudplatform-single-spa/key-manager (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in @cloudplatform-single-spa/floating-ips (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in @cloudplatform-single-spa/magic-bridge (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in @cloudplatform-single-spa/disks (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in npm-builderio-qwik-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11a743cdce28dd141d636ff13baaee44df53fbaaed17efdc5a7380281b7097e1 The package's main entry index.js is a working browser exploit, not a library. When loaded in a DOM context, it creates a hidden iframe pointing at...

Malicious code in @antv/util (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in vv-ftend-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52e6dc460495b044b5104f5b43ce39cacbc3bddfd089ca9f48ba821fb9d9b77c The package vv-ftend-api was found to contain malicious code. Source: ghsa-malware 516291f1a77610b9273279b0bfc4b6502c42024be5ce84308ad96ab226fa216d A...

Malicious code in urllib-slim (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 acbcedbcc1d5bafffbb66128eae99b1fdc6c8e62b65bedd8f62ee2790919d972 During installation, the package starts obfuscated code that downloads and runs remote executables in specific environments. In some packages in the campaign,...

Malicious code in gradual_fly_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09731b4795cfb890b18180946754e2fc9c3c712443a289e3f2180220eb26150f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bundlef-lib (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...

Malicious code in verify-contract-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1037ebeeb5eff8da3b46c8275a09151604157ddc24db244d76d27d97bfdddad bin/cli.js executes whoami and reads os.hostname / os.userInfo / os.platform, then POSTs those values to the hardcoded endpoint...

Malicious code in autobahn-electron-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9a749e23bbf7c5ca871c797923855dc2c7fe1006c5843ed8a13292d7fbd4256 package.json declares preinstall and postinstall lifecycle scripts that run curl against...

Malicious code in @pablo_clueless/printr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13ba2a3695f8d0fa63fb6558e66660f1e3b4a6f4eb080b86c486daae6f55102b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...

Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

Malicious code in @keyv/cloudflare-kv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b3d12d9e6fc46545510e3656381bca3029ff156434a34d54b21ed45d3c4145a @keyv/[email protected] is a Keyv storage adapter for Cloudflare KV. No install-time lifecycle hooks, credential-harvesting behavior, obfuscated...

Malicious code in accounts-loading-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d430e8d55d80c0cf747e6c04058e0bc90274cc943a0e6e15651924c90be46d2 On require of accounts-loading-state, index.js loads setup.js which schedules bootstrap via process.nextTick. bootstrap detects OS and architecture,...

Malicious code in pullingpackageeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eeee23ed9e5f55520bb0d6712d26704bf87dc9badeec3180c33a6d2eb31cba9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pp-react-ui5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee26042aed9ed8c50ffaa9b8fd40df265099c14441c38542bbfce3c529ceef3 Analysis of [email protected] 4 files surfaced no behaviors matching supply-chain attack classes: no lifecycle scripts fetching or executing remote...

Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...

Malicious code in automatic-octo-invention (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2dfb4e3eedab24e355b6d24db6096e6752563e220d28e83ad2cf213fe49fd89 The package ships an 8.6 MB stripped ELF binary at automaticoctoinvention/claw sha256 f6fe45f8fe9081987505af31f0249021a65b558af514f2e4e37340fb3182805...

Malicious code in telemetry-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f21f282e7349c68d7ff17d0b5c452fb51c3bab106ffb6f56dc80f108c4b0800 The package's Control.plugin entry point calls PluginOptions, which fetches a binary payload from...

Malicious code in abseil-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7087d90aa66c4de3fd4d92cd4f25088ea3ef20c78223a787768779ef5e1f0ac6 Distribution name abseil-py name-squats Google's widely-used absl-py Abseil Python common libraries; the import name abseilpy also differs from the...

Malicious code in telemetry-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca5a92b8a793861df4d3480ffa064564909421659b72e6a9bb1f6af72847f55 The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all reference the legitimate...

Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...

Malicious code in @across-toolkit/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7f4d3a8ae39148bf9964aef6bfe64bc57393c27a28d8e953b30c92442c4b33 @across-toolkit/[email protected] runs a postinstall.js script on npm install that harvests installer-side secrets and posts them to a hardcoded...

Malicious code in @fhkry/x-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f6c3e5c391d9d3ffeb7f6c1b4154b0266efeb73bdf5543ad81f50236bdabc This package presents itself as a fork of @whiskeysockets/baileys impersonating the original author 'Adhiraj Singh' in package.json and exposing the...

Malicious code in @sauruslord/libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c2cf2672d98396a7b66cb732741d269732f5faae72293ea46e06b879e7a45b Package name impersonates Open Whisper Systems' libsignal-node but ships unrelated code. On require of index.js, after a 1-second delay, install.js...

Malicious code in core-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad83962ee4db02c1bf43558ed5fe6bf79f66754b070415223d29643a8ff754e core-dotenv presents itself as a dotenv/env-var wrapper. On calling the package's config or get, which lazily invokes config, a worker plugin.worker....

Malicious code in proxy-checker-j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual...

Malicious code in proxy-check-ii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a736498f3f882a4ba79f793dc893883db41d8cb5a74ecfe0c66dace9cc477a20 The wheel is advertised as 'proxy-check-ii' with a one-line summary of 'packaged command for running the bundled qsshd executable' and no README,...

Malicious code in chain-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aabf751a767ad631ac38651254930d99c8ccb0feab8dc5c96b5d3ab243796ddc The postinstall script fetches YAML from https://chain-devkit.com/config with no version pin, hash, or signature check, then parses it with js-yaml...

Malicious code in n8n-nodes-social-facebook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff182b11223b46877e54226944a8ba245ad486dd9dfd1027810a42f9c9e06a1 This n8n community node advertises Facebook automation and instructs the operator to paste a full Facebook session JSON captured via a Chrome extensi...

Malicious code in @tabrex/bs58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f8a6402182b6dec89b04f15d70fcdd2b78d678947d49c62a3f09b11a70bf306 @tabrex/bs58 ships the verbatim README, API surface, and repository URL of the legitimate cryptocoinjs/bs58 package package.json declares repository...

Malicious code in filewisee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758d74e75086465a01c3837210bf5bafe22d86e6f087be963e39ccd62ed0b034 The package presents itself as a date-formatting utility and re-exports plausible date APIs format, formatISO, formatDate, formatTime from...

Malicious code in loading-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94 Package name impersonates the pino logger exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js, lib/redaction.js,...