Malicious code in trongridi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103 The package exposes a single public function permprivatekey that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint...

Malicious code in @yane88/workbuddy-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1067553b82d11f9e2a38c4d59dd3b450f722d5572fc8bb43765d5093f68cc23f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in h2-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0176fe223a6df20d633d05a3e0ab21c2e87d0169342e820beadccc5817acc7bc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in grafeno-billing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72306b800994fea3aa6c6d12e137657ffe70ec9ac6c44abfe3ceaa547ef8e5c6 [email protected] is a stub package whose only substantive code is a preinstall lifecycle hook. On npm install, preinstall.js enumerates...

Malicious code in npx-oob-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6302c47700c024cb727f6139b5cd8703da7c295555525ce9624c12b536f76dde npx-oob-package ships bin/cli.js which is also declared as the package main. On both CLI invocation and any require/import of the package, the module...

Malicious code in supersignaturenature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15 The published dist/ bundles main/module/browser entrypoints contain code absent from the src/ tree: at library load they read an encrypted rsaToken...

Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

Malicious code in qbo-ui-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7391c0f366c6339b3c6c75a1e891d1123cc4483ba3c01eedc20ebbbe3dfc48a7 package.json line 11 declares a self-referential dependency whose source is a bare HTTP URL rather than a registry version range: "qbo-ui-services":...

Malicious code in jsb-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368bba2e9d134a0d1ce565627644361ebe98bbf7bc2fd04812ff7137c300eaac package.json declares a dependency whose key jsb-adapter equals this package's own name and whose value is the bare HTTPS URL...

Malicious code in 3layerdipstackhr3ocw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f7f5462a6cad4608977cbf01ae1fab24a1257afe36d254ce404ca49b5aab99c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in secure-test-browser-4np1hfmm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90716231448c304793ac2890ef392c0ac3cce0160fd30f4eb3abaa242c3cd866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-j8hvv68h (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e289f65e489b05a44a20cd99c0016aa894d0d9e009ae0c7cb449e8f2b703978 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-demni4rs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce78fa48ef0610a56f804bcea423bb554b2aa4528a6ac7ece1108f3f52b56b22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @syncraft-labs/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9 dist/index.js the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack contains a heavily obfuscated block using...

Malicious code in @wizloft/harness-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554 dist/index.js the package's declared main contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. ...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...

Malicious code in dlmm-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ddf2d03d839f7eff709e78da1d6a85226cdd3b9171dbcb59a4a95c741e0773e The package's top-level module runs a report routine on import, and setup.py invokes the same import at install time. The routine collects environmen...

Malicious code in @decido/backend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8 The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware...

Malicious code in bigops-status-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts...

Malicious code in bigops-storio-ngrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...

Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at...

Malicious code in @servicetitan/startup (npm)

npm/@servicetitan/startup is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in postcss-motion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4534713b2409f1fe5588befb885030edc2eafddf215d1103e70f9024c64cbc35 Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its main index.js is a 164 KB single-file...

Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...

Malicious code in xerohub-discord-voice-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a2e867e455a79a59e233b1536348eca9ba4b72c217997c4ceea032e7a5ad2fe XerohubVoice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the package author. startVoiceJoiner...

Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

Malicious code in lambda-cloudwatch-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d62c2ab5388572a03d3c4f28ee268d562675a2ebbff48cf1375728f837365f4 The package's preinstall script npm install @sentry/node && node examples/verify.js executes on npm install and initializes Sentry with a hardcoded...

Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

Malicious code in n8n-nodes-final-mile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2c87dad5030c245317bd34041521d73d8c112d79018db381d749c80739d539f The package advertises itself as a community utility node for n8n but its declared main index.js is a self-executing IIFE that runs the moment n8n...

Malicious code in n8n-nodes-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9d1aeabd688ffe2fdb4206f6fc715413358a40ec3203ad213dc37bb123eaf62 The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at module load. On require, it...

Malicious code in @hibachi-xyz/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 214e1b690352ce0af70ce6a37d3b7ac4d8dec4269dc7606b7a65fbb6d4406e8b The package presents itself as 'Type definitions' for the @hibachi-xyz scope at version 99.0.0, but index.js exports an empty object and its only...

Malicious code in syft-acp-atoms (npm)

The syft-acp-atoms package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in @fhkry/baileys-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1df6de5ff23e958b57990b451c573aa5d669585436b369cffc01aa122aa8f647 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bcs-mi-ui/message-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58c86304011c297c4b10092f83a6dc1763b8174e91fd9e81f8487b959ecea539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

Malicious code in iwsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in akshajrawat.utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 105157af41712b64f8b36ec1cb01e28958e4ad828a0c08d0979a1f6e22d1f13d The package's package.json declares a postinstall lifecycle hook that runs automatically on npm install: node -e...

Malicious code in micro-ui-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be44655a47177f3740201ddb9dc66db080b9f665354c78bcebeb9a2da3b11b7f On npm install, the package's postinstall script postinstall.js reads os.hostname and sends it as a query parameter in a plain-HTTP GET to a hardcode...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

Malicious code in @omniwatch-wick/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd38262e49e1e621fb0a2c3763f2736b2c893f18f24b5d019fc3febdc9ad172 index.js imports childprocess, os, http, and https, and issues POST requests to two hardcoded endpoints:...

Malicious code in node-fsmetrics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b67fad1d72f63941a3973df07e6cbd980c9e3c3bbe5041818f58b9be07d6b7e9 The tarball contains archive-sender.js, which tars the directory /root/.codex, splits the archive into 200MB chunks, and uploads each chunk by runnin...

Malicious code in node-path-addon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dbc52a88818bccd5602eb556ea4bf089dac66c44a2bb1ecbd6fddd6723e9d1d node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry path.js delegates by executing...

Malicious code in chain-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c281292766d55cda3ff1b006154150aa05d567a4f8115534788ffbbc014f3e7 chain-guardian presents itself as a mocha gas reporter typosquatting eth-gas-reporter but its main entry index.js contains an always-true gate var op...

Malicious code in frontend-regulations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d88817d57907505adf7d303019c78adceb6da7bedf1e3416f2b9a1e80605ca1 [email protected] is a near-empty wrapper index.js exports an empty object whose package.json declares the dependency 'ltidisafe' with the...

Malicious code in another-poc-by-tipsen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1bd73ac39644da27df81fcbc6540647d0f13d77419a07997a8ca0a2baa6164e package.json declares a dependency safe-chain-test sourced from a tarball URL on an anonymous Cloudflare tunnel host...

Malicious code in testdonotredeemit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9f9461b13f64b90e569dcc6354708559128c23f4e47e4ac5842b46ce0fb6ed2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in abuden211 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b56fab3567bb384777773b6a1a1793f1842ae69d9937268e4c6d837072f51ac The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in abuden26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 440fa1b32d35cf2c41253e2fd1f63095ea65ac7733fa48edc9abef43877659c7 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...