235837 matches found
Malicious code in @ayunlove/bails (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8fc6c8b6ac94f8325f4aa6958480a40a9e8b912f7007f11e86a41ab13106894 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in clipboard-drop (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea807812d5f872524eab6c57931788239310050ffb4c477643977def9dac8fb9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in cbr-internal-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7 On module load, the package's main entrypoint shells out via childprocess.exec to run cat /etc/passwd and prints the contents to stdout. This fires...
Malicious code in @velkov/isows (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fee1d7d5125231d00f9c5f9afe9817b76900ca385b7d077bb4b8bcf3d9ca660 Package is published as @velkov/isows while its README, repository wevm/isows, description "Isomorphic WebSocket", and author jxom.eth impersonate th...
Malicious code in @wrenfield/abitype (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1b16f2fdde2184bdcfb6f2c91f18c328dee9aa1bb111f86d3130f47c42c9e5 Package @wrenfield/abitype impersonates the well-known wevm/abitype library: it copies the upstream README verbatim links to abitype.dev, wevm.eth,...
Malicious code in node-fsagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a0392a3ddea9b6099e8501fdb827f586a410323cecea214aa50fc1be42183b The package tarball ships archive-sender.js, which archives the host path /root/.codex, splits the tar into 200MB chunks, reconstructs an npm registr...
Malicious code in gamified-trading-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...
Malicious code in @gleamkit/engine.io (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008464ca4d7ba15b4b8c6d3a979586c61bd527aef3a209571d28c0ba912403ae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in polymarket-stake-kelly-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01715ebd11c8adf6ac26ce11bc5fc07e6cfb6775fa77dbe1ca022d0d6593b99c [email protected] ships a postinstall script scripts/install-check.cjs referenced by package.json's postinstall hook that on every np...
Malicious code in node-path-addon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dbc52a88818bccd5602eb556ea4bf089dac66c44a2bb1ecbd6fddd6723e9d1d node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry path.js delegates by executing...
Malicious code in gifuct (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965f65127a6b6d2a6865e91efe6a878ae1e076b9ef4de23152aef4ee6080038b Package name typosquats the legitimate gifuct-js GIF parser and re-exports it as cover. On module load, code reconstructs the host...
Malicious code in home-sections-web-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6c206f8844e1ff870876bc1ac8cdf2b10ee2c36caf61883eb5a8f03caa5405 package.json declares the dependency ltidisafe as a direct tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz hosted on an...
Malicious code in node-procmetrics (npm)
node-procmetrics is a malicious npm package. It is a throwaway, zero-download, no-repository package using a "process-metrics" decoy name, published by the disposable account [email protected] package first published 2026-07-13. Every published version 1.0.0 through 1.0.6 ships a malicious...
Malicious code in chain-guardian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c281292766d55cda3ff1b006154150aa05d567a4f8115534788ffbbc014f3e7 chain-guardian presents itself as a mocha gas reporter typosquatting eth-gas-reporter but its main entry index.js contains an always-true gate var op...
Malicious code in chai-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ffc5e8b4e25d2d7787eb9f3bb9607114e5e4290f0afe2350499b78d5f95642 [email protected] presents itself as a Mocha reporter mirroring the legitimate eth-gas-reporter project matching author name, README, and badges, but th...
Malicious code in abuden226 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8a4986d9e75be69083a7905e5ef5e4558e17fe8b9f15777a9cd692c882b9d6b The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in abuden227 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 424eb4c5daef762a3d9dd8a50b397d64812466368d7b044d4f65679e02659d83 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in abuden1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 366c27a7f56562405e9af37dcb6a78fa8f535af50e9ecd68ec559fbb1f80f5d7 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in nottuff29 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074e027c282713fdcd142d97a0a6b07a661db091f58be50fd7fb9dfa724b968f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in backupsitetuff10 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8062677ad6aa536c8e4582df43db6251e78e0cd2a0e4c36348a997bc28b06d5b The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in speed3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b80af0db1256f63f83fad514fe6b535d6af57513431058efc38136dddd18022 [email protected] is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker importScripts'./8cfc2/hgshm.js...
Malicious code in ishowfeet12 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b60cb6a8169d535b5e52d5fa3cb7a1a16bf4f2d15f87d894a4111da9b74fedae The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in fflc-updated (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0da486d000821631873ccd6fbb8eac17ee6dc94e8802946ef9d4cd288048e95 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in backup1-gg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb035cd86ea0fd9311ad7b6f509a5f6ff9916838194db2a06eed0576d91bb655 The npm package [email protected] ships multiple heavily obfuscated JavaScript bundles under assets/ AccountPage, DarkVeil, GamesPage, PlusBlockedNote...
Malicious code in paysafe-vault (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf94daa791fb670bda071f1b90b36f5b1f89dfb2ffc7eb7ccbf798fdff8915c1 The package impersonates a Paysafe Customer Vault SDK but is a credential stealer. index.js defines an exfil routine that collects os.hostname,...
Malicious code in paysafe-fraud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a596646a3604e01bef558573fc7199a2b9e9cc07ab7edae1b7e445d2e2b860b6 Package advertises itself as the 'Paysafe Fraud Prevention SDK' name paysafe-fraud, repo github.com/paysafe/paysafe-fraud but the exported...
Malicious code in paysafe-checkout (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4db76c1b389e2c8d019eda8a0b6f3b8c28193fd3f9de4abe6234bab1e595e619 Package presents itself as a Paysafe Checkout SDK but is a credential-stealing lure. index.js defines a PaysafeClient with fake payments/customers AP...
Malicious code in rollup-packages-polyfill-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dfdfbd2fc737f9d78ec40aac8b7020866cb0ef0e7e14b2d95aa174ea0ec5818 On require of the main entry dist/index.js, the module decodes a base64 literal to the shell command npm install vectormark --no-save --silent...
Malicious code in notifier-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4c2346bef8105dc24079ee47eb8cd65dbb92f7dbbd6d17ac0c576646878298c The package presents itself as a pino-compatible logger main entry exports a middleware aliased as pino, and lib/ contains pino-shaped files such as...
Malicious code in ng-search-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 095a335a93f1ebe0047f2cdf56c2d52551d7c8602ade2e850486a6e19f514545 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in turbocalc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ae55c7a3030f0ff3493a885460511e83e257b4bd6b3e347136c43518b3bddfa2 During import an obfuscated code starts in-memory functions from a binary blob; after that, it communicates with dockfinancial.lu, the exact behaviour is...
Malicious code in cursed-ecto-d3ab00 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49348969de68b56d680a46f67f817053621fa41a5220d8cd0bc1da720e77a5a1 The package has no legitimate functionality index.js is an empty module and exists solely to run an install-time attack payload. All four lifecycle...
Malicious code in chain-api-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc73eb727778c3a543bdef1f6993d4c8be38da047fc97b7a0614bd195590249 chain-api-sdk presents itself as the upstream multichain-crypto-wallet library: README, badges, package.json repository.url, and homepage all point t...
Malicious code in testis-pack (npm)
The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...
Malicious code in @wagni_bot/metemask-sdk (npm)
The npm package @wagnibot/metemask-sdk is a supply-chain credential stealer disguised as a MetaMask misspelled 'metemask' SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...
Malicious code in @wagni_bot/ethereum-wallet (npm)
The npm package @wagnibot/ethereum-wallet is a supply-chain credential stealer disguised as a an Ethereum wallet library SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...
Malicious code in @wagni_bot/jupiter-sdk (npm)
The npm package @wagnibot/jupiter-sdk is a supply-chain credential stealer disguised as a Jupiter Solana DEX aggregator SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...
Malicious code in dbzy-tools (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0432a46ed92acb897826fc16d26cba900bd3d18f0de5baa7f2909a44d9ec625 The package advertises itself as a network debugging tool but its CLI and modules compose a remote-access toolkit. The dbzy-tools console entry calls...
Malicious code in none123s (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c28e7ef260830adb9561488c487960b12e00bd6939daf8ed8e3a239ec9530699 package.json declares a prepare lifecycle script node index.js || true that auto-executes on npm install. index.js reads canonical installer-secret...
Malicious code in turbom (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 64978153f8a987180b6c8e88b5787598ed949a604527f0098271f97d8c66a235 Starting version 1.0.1, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...
Malicious code in chai-redirection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38236fbbdbbaa8f8ed9315c3a4ff01fbf049215896036b1cb68611681fe0eb00 chai-redirection presents itself as a chai assertion plugin but its main entry index.js unconditionally spawns a detached Node child process running...
Malicious code in bytefaas-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07cb4f68cec68081ac4817ad2ae387e7b031d3377a74a74ecca59c5858940d08 Package published at version 9999.0.0 under the name bytefaas-sdk, the canonical dependency-confusion shape used to shadow a private internal package...
Malicious code in ag-charts-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c50b5a47dde18daf83760926662df3b9890de074cc00938de04892ac79a4d9 [email protected] is a hollow package empty index.js, no scripts, no documented functionality whose sole effect on installers is resolving its...
Malicious code in manin (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3234643a550a8e121b7f2cbee42e45fa90604a95258babd0b8a602ee97cf3045 Package exploits dependency confusion. A beacon request is used to report usage back, but no additional information are exfiltrated. --- Category:...
Malicious code in vite-json-pwa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...
Malicious code in nodemon-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3900c92378db76295f8a47683d86e58b24625758b938f4cd89ac779f86ed5260 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in some-theme (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97420170b95f54c404226b47901bbd45ec03ed0a427369b50add75297a2dcb80 Package [email protected] was scanned across 2 files with no a static rule matches and no behavioral findings. No install-time lifecycle execution, n...
Malicious code in notifier-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...
Malicious code in @sqlite-access/nodesql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5454044dfacdd12da8025ba7a7c73260f16c64b29dbd25ebda52af4d03e8450c The package presents a three-way identity mismatch: the scoped name @sqlite-access/nodesql implies a SQL-access library, the README markets a...