Malicious code in move-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00077e83bd841dae96e61d432da796cf21839a32e5caf03e7256b2573225335 [email protected] declares a postinstall hook package.json line 7: "postinstall": "node install.js" that runs install.js on npm install. install.j...

Malicious code in @aubea/mars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc44d9f879ce07c857e122c24664d6ae0445cb55aceeeb12c898d65898f7617 When invoked as its CLI npx @aubea/mars, the package opens a WebSocket connection to a hardcoded third-party relay at wss://cho100.cn/mars-relay and...

Malicious code in @activepieces/piece-base44 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183bc897806f97f30cf26098efd5714de47475d007a7d5e23fe8fb05dbfe9df7 src/index.js requires childprocess and issues a ping command at line 16, with multiple POST calls at lines 13, 14, and 29 to hardcoded destinations...

Malicious code in @activepieces/piece-google-bigquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3 The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require"childprocess", an OS reconnaissance...

Malicious code in streak-cache-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135 The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a...

Malicious code in bigops-status-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts...

Malicious code in devplatform-vite-plugin-gle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev,...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

Malicious code in devplatform-sre-devplatform-sre-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90a5c16f77f85cd9f782efd521d9f6d2b677ab2468503d191d8763c400f366b8 On require of this package, index.js loads helpers.js which selects an OS/arch-specific path and downloads a native binary from one of three Cloudfla...

Malicious code in @wethenorth12/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e208f50bb22bacadd2c6debf8e973a50ba3a59db74e9c618fa28202eac96a64 @wethenorth12/playwrite is a typosquat of the popular 'playwright' package. On require, index.js collects process.env, hostname, username, homedir,...

Malicious code in @servicetitan/startup (npm)

npm/@servicetitan/startup is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @ornikar/eslint-config-babel (npm)

npm/@ornikar/eslint-config-babel is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in wacve-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071 On import wacveutils, the package's init.py unconditionally invokes checkforupdates, which HTTP-fetches a hardcoded GitHub Gist under the user...

Malicious code in node-fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fc78fcfb574c958db27a4d94c79bd1ae87c3d5790fdcc044e47f2f97980cfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dash-merge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 533b218de7d9e1e925383f5f75cd29a4a2b6869e3d9a104907d4b0d133875a37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in identityauthorizationserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4808d7fab80b2202538cad6c5a1be4d62eb973ac35eb3a431fdf33f68b67ee [email protected] wires scripts.preinstall to node index.js, so on npm install the package auto-executes code that collects host...

Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

Malicious code in gpaas-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f698d94fead72f888459a0773a7715dd974433c4624134b743098b61e74f9a9f On npm install, the package's preinstall script runs index.js which collects the installer's hostname, platform, architecture, home directory path, a...

Malicious code in svelte-streak-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45dbfe79dd6fb079811b798a734de0a661605d420454d97a0635dbdaec621efd The package contains no static or traced indicators of exfiltration, install-time remote code execution, silent-relay, credential distribution,...

Malicious code in n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9256e5f20f66f3eb9875dcc475299249173730d784230eb157c327171d114e21 The package advertises itself as an n8n community node 'Utility nodes for n8n', but the declared community node file MyNode.js is an empty stub and t...

Malicious code in n8n-nodes-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991093c97f0d954740c4b72a2e7725a501df211c94634979ebadc52652f2ebe8 The package impersonates the n8n task-runner subsystem but its shipped n8n node MyNode.js is a no-op stub whose execute returns . The real payload...

Malicious code in streak-daycount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f787426dd4d04d5cd527bdb19d309c64de82e252af4af0714dc33b07a26b73b0 [email protected] ships an index.mjs whose top-level async IIFE runs on import. When the host is Linux and NODEENV is not 'production', the code...

Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...

Malicious code in colorstack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05f3b08a41e5239924e109a14b8d91b4542bbbdddb1138a1bc6c9cfb7137b053 The package publishes as 'colorstack' with a summary advertising a color/gradient library, but installs under the import name 'newcolors' and exposes...

Malicious code in rasterkit-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d748af7546aacbfca356759d4c81386f113a32dfc80ff8bb75da3eb3c8b4358d rasterkit-demo ships a CLI entry point rasterkit-demo whose rundemo function imports demochannelwindows from PIL.data and passes the returned buffer ...

Malicious code in defi-kit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d On import defikit, the module compat.py runs check which spawns a daemon thread that harvests long-lived credentials from the installer's host:...

Malicious code in @public-for-cdao/sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in nemopush (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58d2958d0307dfe5b73dc1eef5a46e96c25f94ea31a0b4ab8b43a1878d427d2d The package advertises itself as 'A push notification package' but ships an 8.6 MB opaque ELF x86-64 binary named claude and a start.sh wrapper as...

Malicious code in @gocortexio/npmgremlinbox-openpbs-2-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a66e3fdf500614035fa89cb285a3a94a898e6890333031745ac4312f6e5caf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-mpl-1-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b711dafb2bb4c7dfab16c8144346191d7e09f630cfa91e7dd9e3b9b9960151 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-sspl-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51a3085bc9faab57c90c38baca435c26660d07c33670e21aaa5468250e0d4061 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-sendmail-8-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 112e0a80917ce922de20557d22ea75375b07d627784966638b99e1d4ad46a355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-epl-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52212112115a7a68e8599473664e623f46746dbdc2eea1ff36ccbbc2959c5ccd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-eupl-1-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97e8d42e9c8b5f383e3cadbce8ef073636d53169b5e36e519cc4611ea1b414b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-cddl-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 619607f5798c23f341f128fc384bcdbe47227d125c7377a64a950cc36c6c4391 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-cern-ohl-s-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22ddcc0f57aeab54d998e596dbf40296544f7c8ac4d6feb64ae414f81597c6f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-2-0-uk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b696f700f27e6f4b535ddb3bd94693d82151e3264fd6813b075872a5caa2c0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-de (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2ec8b494d13d9e9c582f801e1fa46d371b6810b130a93614926880e26b4bcc Package @gocortexio/[email protected] was scanned with 4 files inspected. No a static rule matches and no behavioral findings we...

Malicious code in @gocortexio/npmgremlinbox-agpl-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35ec6a36621ce352ab4510c339ef6a7367f88584b90ebfda17149c79dd947c66 No a static rule matches and no traced installer-harm behaviors were identified in this package version. No lifecycle-script droppers, hardcoded...

Malicious code in twilio-deploy (npm)

The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

Malicious code in markscan-api (npm)

The markscan-api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in twilio-platform-async-data-fetch (npm)

The twilio-platform-async-data-fetch package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

Malicious code in tinkoff-cloud-apis-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421b85b858849bbf116303f2dc2740180df602dfc162f7ce7fa109e4c39b07ff The package installs a telemetry.pth file into site-packages via a custom install cmdclass; the.pth line imports telemetryinit, causing every...

Malicious code in n8n-nodes-api-finder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c Package advertises itself as an n8n community node package.json declares an n8n node MyNode.js, a benign 'API Finder' shim, but package.json main...

Malicious code in @thepayulink/server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0f04014bd624dc0712b8bfb78c53832ef18bf6a178d462b1959df9a8b81ec94 The CommonJS bundle loaded by require'@thepayulink/server' dist/payulink-server.cjs hardcodes apiBase to https://eliteyatra.vip as the default...

Malicious code in phantomx-tool-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e528800706b219f69d8bc87eb77203c752c8b4720e8c0b8fc04cad6df8ce1d When the tool-server bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers...

Malicious code in @sciagent/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 310123a94891174b8cfa55def38b6e916b89d43306a52793739f26289fe51e4d scripts/postinstall.js fetches a 10MB+ 'sciagent' executable over HTTPS from https://u250924-adc6-f977430f.westb.seetacloud.com:8443 a rented...