Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

Malicious code in @peptide-unit/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in fluid-type-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...

Malicious code in express-self-destruct1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efe4bb7647313d9772c059e46a877ab095ada0910845e5605fbb317ab2b01fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wsh4_edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...

Malicious code in page-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99958415864bd2ddd266b99c59cdc35841e7efd9eff38481d69f4e740badd958 On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home directory, DNS server list,...

Malicious code in merchantprefsservice-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145fc1d224cc012a8cbdea5823b1573df6400ce6a24837b2c25710772152724f The package's preinstall script index.js executes automatically on npm install and collects host identifiers — hostname, platform, arch, home directo...

Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...

Malicious code in intel-cicd-repo-infrastructure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...

Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86481ee3f08109eeaec60a41afb7c2e8d03efd680cc5bf846bdc342ec4205205 The package advertises itself as a high-throughput bulk-mail tool and ships every one of its 50 JS files cli.js, denv.js, helpers.js, all commands/.j...

Malicious code in react-tabulix-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e1730bc033ffe3e5cbe24819446e0c6d41af7bec46ec931a04eca2909ffc7cc package.json declares a preinstall hook node./dist/index.d.js that runs automatically on npm install. The script at dist/index.d.js decodes a...

Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee7c2ba53e2c7adae6a2b54776c21490794ee8f28fde98f5c61778380de1382 Package [email protected] contains 2 files with no a static rule matches and no traced behavioral findings. The version number 99.9.1 an...

Malicious code in ml-core-airflow-auth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a543a55b463967fa7f6b3c1462ecb38735072a4f4f47bf5f9b732e089a64b8a The package advertises itself as an 'auth token handler' but its public API src/mlcoreairflowauth/init.py exposes only a trivial in-memory TokenStore...

Malicious code in solana-web3-lts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed Package name 'solana-web3-lts' resembles the widely-used '@solana/web3.js' Solana SDK, raising name-confusion concerns for installers reaching for th...

Malicious code in my_shoaib_gem (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hello-world-test-mh3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd Package is a trivial hello-world test artifact. setup.py contains an execbase64.b64decode... call at install time, but the decoded payload is a singl...

Malicious code in neroteam-v1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19 Importing the nero package triggers nero/init.py to load nero.main, whose top-level code runs a guard routine before executing a hidden payload. guar...

Malicious code in @gocortexio/npmgremlinbox-malware-network-indicators (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d967f359f34a28a80622abb6fea5e47bab0c729e194cec31c48c870568c9f1e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-unlicense (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23bb2676a768ebd0e40b34368cca60d48ba7bec21c362d307e1ff87d04b3ba44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-copyleft-next-0-3-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf6ed48efe682ebb1ee6a19edd4529a25aed3c46f8fb6686228de074a424a4a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-typosquat-commander (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c49af3974e2d4e9ac4f2118230b82c0fbcca062f8b45fa85b792ab6deb516787 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-ncgl-uk-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00382b16f7bcacbf6333acca5a11b4f1be3a615a64431e0781cf8d9c3877b813 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-typosquat-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 549eafb217d88c4caf074d8a74e4dc3c2e49f0fc7fbeccb2983eb72bf05fae68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-malware-install-execution (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a5a537b1738692165e905b11697bdac7455cccde5bf8b788767642d26c33b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-typosquat-moment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19008091c460cf10b254f3077108bad3b1c5289e85ae59ba7b873aff7d96866d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-fdk-aac (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6207192112f56fc40eade4e0eaad3581eef98f723337ff802ec60e569ab6bba8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-lgpl-3-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ffbaf84d551bd209b6379464d7695700178fc923056a9db13e0d7201bf3723d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-uk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c31160d30fd76b0823b67a8f9a4161aea511b56c897ae8153edd2c0e621f979 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-3-0-igo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ad0f72a8295e2a43e599a9b2afbc64201b6b7ca56c9b4f2161ddc07f3f25120 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3905018e59676370cb9b0ce2f68f53df18b3ca774fafd9445bd3ce202ab0249 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6b2260e2800619ccb9a093618b29bba531fdca6348febc8547be7d925da7b4c No a static rule matches and no traced behavioral findings were produced for this package version. With no evidence of exfiltration, install-time...

Malicious code in telebot-bot-run (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c556b9ded1648a2523210bf518dea35324c749733eabeef3268795351b1b9c On import, telebot-bot-run 0.3 executes two attacker-controlled code paths against the installer's host. First, the top-level module fetches...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in netcontrol-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 967b375e5686bd1eab74838f00cd21c2a8e15291f03a8140b494a83052fd2a92 netcontrol-agent.js implements a remote agent that long-polls a configured server URL and pipes the returned bytes directly into an interactive shell...

Malicious code in websight2-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...

Malicious code in @sauruslord/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7572befaa64e1e08790af3235ffcc091d379158bf1389c1be9c67d30e3d205a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zaldy-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 804d498227f490452bb4c9d7ba63c34b0c6edb50e0726c32e1ef5085f76a1b5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in saurus-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c66bed79555a8ded86c45232c26e4b94785b5789d2b681a93e92c93ef95eb966 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cppt-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484688d5963a9246f4fe7a2b5c1c7ebe6bba135a2a5df66b3ab57f44978407b2 [email protected] declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js collects host and user...

Malicious code in chai-as-hardened (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20c6afe564cf46f02258e635c1b08a802cd4f9b949e098710f44544cdbb86dfd On require, index.js spawns a detached Node child process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL...

Malicious code in http-ws-listener (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b70acc8a626218c5855ef656a6945f1f2018c0ff62c112d9b31bae5016fae49 [email protected] ships misc/configFetcher.js, which reconstructs a hidden Pastebin URL and the module names 'net' and 'childprocess' by...

Malicious code in ahooks-3.7.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6816bbe8dc3e7d033a03452f7c1e8f873b97c158165faa863694ee13eb6dd61 Package published as ahooks-3.7.8 at version 13.1.1 with empty author/description/license impersonates the legitimate ahooks React hooks library...

Malicious code in postcss-selector-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fec62079856815ded46ba283769d3d3e0d20e08b6196b8698e08e2df6677ee Package is published as postcss-selector-minify a word-order permutation of cssnano's widely used postcss-minify-selectors and registers itself to...

Malicious code in ethereum-lib-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58bddf420dcb894a940b62fba777628f0c3a9d31dd7fa915afaea618c1914d52 Package [email protected] impersonates the widely-used ethereumjs-util library: the package name, README badge, repository, homepage, and auth...

Malicious code in chalkdevx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates 65 credential and CI environment variables NPMTOKEN,...

Malicious code in crypto-validate-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d8b69cab723043b20a628a6cd17f0e5cc64051004d9beb43d4b9ed58dbd9a0 index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtures/keypairs.dat a 53KB opaq...