Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

Malicious code in fhj8cv9dkwm4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91ea4120fcb82c9a36d533346c28a2ce7ed225ed31a89526d9cee45f0be2581 Package ships a single index.html that mimics a Cloudflare Turnstile 'Just a moment...' verification page. An obfuscated obfuscator.io-style script...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

Malicious code in titan-exchange-shared-permissions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6 [email protected] is a dependency-confusion reconnaissance package. package.json declares a postinstall script node index.js...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637 On require, index.js loads bridge.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads bytes from a rotatin...

Malicious code in devplatform-stylelint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d5c417e542790e2e91860f8383960eecead75556b747c0fdc91227c3228f514 The package is published as 'devplatform-stylelint-config' with description 'environment config reader' and exposes a trivial ConfigLoader from...

Malicious code in dolyame-ui-draghoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b2e12132d37505525293870b3a824831321d42adf75758e949b30139a002955 On require, index.js loads loader.js which selects a platform-specific asset path, fetches an unsigned binary over HTTPS from hostnames reassembled a...

Malicious code in @leejungkiin/awkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add The package ships scripts/dependency-manager.js which, when run as part of the install lifecycle, invokes execSync'curl -fsSL...

Malicious code in agenthub-multiagent-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a agenthub-multiagent-mcp ships a worker dist/worker.js that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/ and, fo...

Malicious code in jagproject (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...

Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

Malicious code in @zahlen/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...

Malicious code in @simplipayng/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ead1207956df050d2746ae899d5ea9132fbc4c35684f9e992599c5ef10259c The bundled main dist/index.js executes an evalatob... blob at module top level, so any Node-side require of the package SSR, tests, Next.js server...

Malicious code in bigops-storio-store-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from...

Malicious code in devplatform-test-pvm-is-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bea9b91a5e345be04b775870b684a468293d7d7e4a49fa31c21178cfcd02f68d [email protected] is a lure package whose index.js requires./bootstrap.js on load. bootstrap.js downloads a platform-specific binary...

Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from...

Malicious code in dolyame-boxy-atom-icon-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766 Package advertised as an icon loader but on require the bundled vendor.js downloads a platform-specific executable from obfuscated Cloudflare...

Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

Malicious code in bigops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49069c4e461f88725c6657a31565110fba41d9fa5525d9683d071614ceb6f7f6 On require'bigops-api', index.js loads compat.js which detects OS/arch, downloads a platform-specific binary from runtime-assembled hostnames fragmen...

Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277 On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded...

Malicious code in @qlik/sdk (npm)

npm/@qlik/sdk is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the wo...

Malicious code in @onereach/regex-helper (npm)

npm/@onereach/regex-helper is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in fsextrra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 317f4ece51d8379de817163700899ce849cc5d750aec0577aa43666cd8a325ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

Malicious code in tailwindcssss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0da18df9b0c152f27cf8431c3ac342f3dd15d7a94ade13a40a7ee7dfcba1614d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dash-merge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 533b218de7d9e1e925383f5f75cd29a4a2b6869e3d9a104907d4b0d133875a37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wbnr/design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd The package's preinstall lifecycle script runs automatically on npm install. It reads the installer's username from USER/USERNAME environment variabl...

Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

Malicious code in @peptide-unit/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...

Malicious code in intel-cicd-repo-infrastructure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc009d2d22b9f02aa6b2cce1ac5eadfcb3f3a7d437cc2ba031eb1e6154da2a4 [email protected] shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, backdoor, or self-propagatio...

Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

Malicious code in n8n-nodes-net-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ddadbbcb032b0a9eb2b0acb04579ceb1da5c1814d3a0d212830b82191dbeca0 The package advertises itself as an n8n community 'Network Utils' node, but its main entry index.js is an IIFE that executes on require. On load it: ...

Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86481ee3f08109eeaec60a41afb7c2e8d03efd680cc5bf846bdc342ec4205205 The package advertises itself as a high-throughput bulk-mail tool and ships every one of its 50 JS files cli.js, denv.js, helpers.js, all commands/.j...

Malicious code in streak-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...

Malicious code in lebinfmt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eaa5c1d1ed763b9e392bd199c360d75b25531b287de9f224e5626e121d649d4 Analysis of lebinfmt 1.0.0 surfaced no behaviors matching supply-chain attack classes. No install-time or import-time network I/O, no credential or...

Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...

Malicious code in defi-kit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d On import defikit, the module compat.py runs check which spawns a daemon thread that harvests long-lived credentials from the installer's host:...

Malicious code in iot-kfh-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...

Malicious code in lwc-slds-lbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...

Malicious code in paperclip-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...

Malicious code in @gocortexio/npmgremlinbox-malware-cryptomining-indicators (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e17110b408450f798af7801913c4ae1a286a4d81496e15d1f79a94426d7ed3e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-typosquat-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9195f06446d35d2bfefdd565bd2c6f88680cd808d77ff00b4ff0b295cc84110 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-malware-c2-beacon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6da5e787cb37cd00670a6df8b8489fd71e5c54b8af2216948669be4a0480f428 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-typosquat-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09f5118144335d297ecc63d98cff64ac6cbe5f93b23bd892706478faf996db98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...