Malicious code in base58-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a7d188e2cd79918987f2008e93bb80ea9979d791b357f8f7cfd892321ded6c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @sqlite-list/schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db66a72ece64d62fe02a712d609f136a1d5bae710c8a97b82dde8e7c39ad9bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zircuit-reporter (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wreactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in ureactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in suit-base (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in smtp-test-server-node (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in reiactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in anguxarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angusarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulorjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulcrjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulaxjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulanjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulamjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulaljs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulagjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulafjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulaejs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulacjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angukarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angujarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zwkact6 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zrztrans (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zpx52530rm (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zjina1 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zjhash80 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zhgx02ab9f (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in xxproxywebtestdfg (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wphraA (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandpdfsvna (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandpdffossila (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wanddbbehg06 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in proxyta4d404a4 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in chai-spycore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbb99516f251bbd13baae5273239a6a04acefea76ddf1a7b06f4b5a328339dae Package republishes the chai-spies Chai plugin source verbatim including original author header under the near-identical name chai-spycore...

Malicious code in cookie-ease (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e657448e95c84051d3c103da0e4bd744f5bc6cbbeedad66099d1ecf4681a65d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8936b0c0d22097170c5eb02c9b183611934e59e7a3c97f94e3a269e13f0d4d5 The package.json preinstall script auto-executes on npm install and performs installer-side reconnaissance and credential theft. It collects...

Malicious code in starlette-healthcheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45d8da59826f5074d5b65d3b4733a4da6e7ce20167db9c14f7004e5fb7abe273 The package presents itself as an ASGI healthcheck/request-logging utility, but its advertised configurelogging helper exposed from the top-level...

Malicious code in test-pkg-pnpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo...

Malicious code in @sudoughnym/enviro-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02c1c204d0f458d13d7140f4b7a007d551095665a418e9146037be9a5b2b7957 @sudoughnym/[email protected] ships preinstall.js and postinstall.js lifecycle scripts that run automatically on npm install. Both scripts collect...

Malicious code in console-fmt-cli (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. console-fmt-cli uses a side-loader technique: it declares decimal-format-core =3.0 as a dependency, which contains a dropper that executes at install time via a postinstall hook. The dropper fetches a...

Malicious code in authsessionbridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c7726c32d14f31a311ae45a86c88fb5c478b8e89d9c71981b7c8ad1da946739 On require, lib/constants.js reached transitively from the package main issues an axios GET to a base64-obfuscated URL at jsonkeeper.com...

Malicious code in crossmint-wallets-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd4caebfba35b43bf10f156fe687f455e95b09a514b8644fe1a900b63f1bf78a Package name impersonates the Crossmint wallet SDK family. Both preinstall.js and index.js import childprocess, capture host identifiers hostname is...

Malicious code in kelly-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 350ccf4a19896a23680e7478be01909de7f16057f175dc14de1d4e0bb92ad540 On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: it fetches a JSON config fr...

Malicious code in leo-aws (npm)

The leo-aws npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

Malicious code in markdownlint-cli2-fix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca7d5154ecbbcc636198bd2314e1916e5f0673d37ab7b14caca2ea96ad5ac5e1 Package name 'markdownlint-cli2-fix' impersonates the popular 'markdownlint-cli2' linter but contains no linter functionality — the README states...

Malicious code in @tinyfox/shapecheck (npm)

@tinyfox/shapecheck malicious version 0.8.7, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern...

Malicious code in build-tracker-n5p1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e731775fde27ad6db493d20397b27eee9b4a6ea0bf515f9516cc974ea3e12619 Package name suggests build telemetry tooling, but the tarball ships beacon scripts beacon18.js, beaconlinux.js wired to a postinstall lifecycle hook...

Malicious code in new-ecro-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4e172aa83f2b8742fb014ea649490c87815573cab692ea74eb402ee23f935c Package new-ecro-1 impersonates the legitimate big.js library by shipping its source verbatim banner, license, and homepage pointing at MikeMcl/big.j...

Malicious code in ioredis-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 387bee0d123eeed248b8be6281784b88d2a3385943a3f696541c1ce48b1c817a ioredis-os appends -os to the widely-used ioredis package name and ships what appears to be a verbatim fork of ioredis same author, same upstream...