235857 matches found
Malicious code in permcserver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...
Malicious code in @omniwatch-wick/cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd38262e49e1e621fb0a2c3763f2736b2c893f18f24b5d019fc3febdc9ad172 index.js imports childprocess, os, http, and https, and issues POST requests to two hardcoded endpoints:...
Malicious code in router-processor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d15d816c739a85908172d716580a6e4cb0655fe7b2fe35293b218db80f9b2625 [email protected] exposes a getPlugin function that assembles the URL https://svganchordev.net/icons/107 from split constants protocol, separato...
Malicious code in @nsub/nitxe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16147b7ac55d6c4cc4e042be73e6d49fc7232e8a03f406fecd034cdd27bf0eb The package's declared npm postinstall script collects the installer's username os.userInfo.username, hostname os.hostname, platform, and the entire...
Malicious code in svg-fetcher (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542aa371fe6b513dabed7c4f9b5646a104520afa686c6b33abedc21d120ea25f index.js exports getPlugin, which fetches JSON from the hardcoded endpoint https://svganchordev.net/icons/106 and passes the response field...
Malicious code in notifications-broadcast (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2 [email protected] ships an empty index.js module.exports = ; with placeholder metadata empty description, empty author, version 99.9.1...
Malicious code in cold-debug-elevator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae8ef53b42bfe7f208c404e2e973600fa174f41c5a2009814f5f0e892769195 The package presents itself as a debugging utility but its exported API is a browser credential stealer targeting installer-owned secrets. The...
Malicious code in express-request-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...
Malicious code in @torbeck/heap (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads @datastructures-js/heap, package.json sets...
Malicious code in abuden224 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b6da7762075dee890b0878af8420637eed76f394f658992c5e10454e09e1e2 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in abuden230 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2234aab0cda39685bbdd725de23c50e6e6b78ca85d8ae3c48dc0577287406f65 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in abuden215 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 895382f96e91ecd3b6a78cac09b905becc2692fef044eacd9ce4d5cb18327b5f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in ishowfeet20 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57470f610cd7e988daef50a3a2587778f3dce2cb1584572d4a1795876f9cf6fe The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in nottuff24 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d91c65c2ae847d5e741575bbc60ac69c0d2aca4973888c6ce2fc85daac3e30 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in ratelimitsucks9 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c5a4a441bf00f2d9dd64e778e4c796779d0a4a216b92bcaee66d8012d4ce255 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in timmytuffknuckles3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca256e52e28fe9f7cfdd4c0b42e699f1b29c5e141df2ad73d7737f522fc7c85 The package ships twelve heavily obfuscated JavaScript files under assets/ e.g. assets/3oruu3por5.js, assets/6y4sp7rdhb.js, assets/wlaswqv83p.js, eac...
Malicious code in sixseven1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96e63dd12f3157bb49fe3951bfb356c83b4b7349eed5947af87b09c40c868382 The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...
Malicious code in ishowfeet9 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248f82bac5fecfd3cc8e27d3c4cc6f48f310aef9c069e64cc33a407cd79369bb The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in sixseven6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fce7a5f40c9f40116627ed8a771d60c34786bc52648e39e0741fe392ed0120b The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...
Malicious code in imillegal5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f821da7c50910d456dfcf5a26ae1afd56a7ec95836a16f570edb014d02a6608 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in whatsadmaidk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 604f59cbac58a8e35ba82016c72efe0c02226eec9273e96ee9215dd72cbe0392 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in omgyesyesyes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eeb53892156b3a1354703f4f8beb2591548726886a017ccc7129407eb128ed9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in openai-apps (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b14c6aa9b0f0ab8c4eef077cf58971cd053092124a8d91cb2d478f04bc22ad4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in mcp-notes-server-poc-praetorian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...
Malicious code in tinyparrot (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9 The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays v...
Malicious code in paysafe-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ce9ede35fc7679965ba83f58e829a328482bf1fbdb2e450d23e20bed24d708f The package presents itself as a Paysafe REST SDK PaysafeClient with payments and customers methods but the SDK methods are stubs that return...
Malicious code in llama-tokenizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02 This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads ...
Malicious code in workspace-scripts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a299d08a926a020ab738de2ff3aee9ccbbdea3f90fc93c0a7a0d2ab8e8b22724 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in chain-async-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54cd392461a3d805dd24f6bc67d354498531f9b42352e8e0c17205351dcccf0b The package presents itself as a pino-compatible logger lib/ directory mirrors pino's internal file layout — proto.js, levels.js, redaction.js,...
Malicious code in cookie-js-ease (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d [email protected] impersonates the popular js-cookie library same repository URL, banner comment, API surface, and reused upstream author name...
Malicious code in chai-as-modified (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab841cd3ab01bfcd1257a214489b41f10e236779e236a0672642777160245a9e Package name is a 1-2 character variant of the widely-used chai-as-promised plugin. The exported function — the entry point users pass to chai.use...
Malicious code in feedback-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b010aedb75591ab2ecad503373bbb8f0bb2bd98637c2e7c68aff89ec3ab26a1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @calm2026/imux (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a755ff37a1fe6e18a3c050a0cf93bfadf80e790fd585c8e09a70179d07ec62f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @wagni_bot/hyperliquid (npm)
The npm package @wagnibot/hyperliquid is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...
Malicious code in @wagni_bot/pumpfun-sdk (npm)
The npm package @wagnibot/pumpfun-sdk is a supply-chain credential stealer disguised as a Pump.fun SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...
Malicious code in thunder-rony (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b49da9c4d3522da30e4c917c3102444f9d61d3ab3e9c547b74b9240168754b9a On npm install, the package's postinstall hook executes index.js, which collects the installer's OS username os.userInfo.username, hostname...
Malicious code in na-rony-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73b485b2a162e7940eb348df343cb7bc4a1a84ab2533e71df742204df778e4b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in hello244b (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 641cbcb87d26ccab92d1273dd083f15fa88ba5dad915c148f6500789f4596e4a The OpenSSF Package Analysis project identified 'hello244b' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in whs4_npm_test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68d797ee3c8111cffee8603aa24625cb71a7f958438e33207b33376b260acc59 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in base58-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a7d188e2cd79918987f2008e93bb80ea9979d791b357f8f7cfd892321ded6c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in @sqlite-list/schema-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db66a72ece64d62fe02a712d609f136a1d5bae710c8a97b82dde8e7c39ad9bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in zircuit-reporter (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in wreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ureactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in suit-base (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in smtp-test-server-node (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in reiactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in anguxarjs (npm)
--- -= Per source details. Do not edit below this line.=-...