Malicious code in stripeapi.net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in solnetall.net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in styled-components-a11y (npm)

The package 'styled-components-a11y' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in zod-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d6e0134575d22df9c8acb633e41aeb44e167203581cee75c81264667e9bdee The package zod-js was found to contain malicious code. Source: ghsa-malware df349fd5990c0cb74fcaa574f32fd30796c00bbe619ee60bd0eac1a658c7dd49 Any...

Malicious code in index-gamma-authorize-deploy-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 855a93e5306676df25469d50536f602165b1a8e5b59b3116fe63ffd6dba16314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in slidev-airbnb-phoebe-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c147ec56a928418476ff97b2e80c13cc416a46f542363a1697c6b3d4e2801313 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-zabuza83 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dafa390f2de66f54b36ad30cb9c93657d3260947ac78c0868d2fbf0403115171 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-lokcek37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8584f7f71b9a5c5e500facfccd9c495c7c8af8838a015c3b31453536e0a85d08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in anyswappoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11b4883135435c180fd5e1ec5f7f3d0ce3da30f86c240121ed36c3f2c09f1441 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in active-admin_theme (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in fca-nvt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f96380ff5d08b4a65d9a20156bb99f8945ff4b34487354b250d78b583013b8d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in h2-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0176fe223a6df20d633d05a3e0ab21c2e87d0169342e820beadccc5817acc7bc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in trongridor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46fcd4ed6da56295fe0a0b4a25cbaf848f10874c6905723472a57e7f59341341 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in payments-ui-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b49e2f4d16837b49ca7d82e2c5a46c2a861c3f2c3d63596c730749dfec0337 package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a...

Malicious code in 3layerdipstackvaovrs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd958de099a50ec5518823e80ef3cbf391707988ca2ed4f30e997905864b3b35 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstacks0fpdw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6fb53f068e1ac90904d145dae9a0e72a5e0c7030a419732819774a659bccd01 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackyq24q (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4de36018329fb320186b7353501b5ad5ad78ef9499881caaa6d8871c04d15bd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dext-crate-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e581bed6c9028ebf84b341f914135c1af62bc9b75072f1c511c4c187cb94abfd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in create-coin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380 Package [email protected] registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards...

Malicious code in chai-as-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/,...

Malicious code in stillm4ddpocs-demo-sprocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced86462ad99b91f0f3e3d344e008ca911a1dccdad5c928cee5da5c651756f1d package.json declares scripts.preinstall = 'node index.js'. On install, index.js collects hostname, username, home directory, cwd, local IPv4, public...

Malicious code in scrambleeeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer opens a TCP socket to bax.h4x.tv:6363, duplicates...

Malicious code in create-react-app-ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ce3734765ee6802d3ccdbbecb091f613417a1ff055ee8fb75ced9f7cf36ef31 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in base99-85x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92b7a4319eaf4f75e0e4138802a61018a4016e0b1ff69e9e8eab51eeb01a240d base99-85x is a typosquat of the base-x encoding library. Its main export's decode function POSTs every caller-supplied string, as JSON "text": , to...

Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

Malicious code in node-runtime-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cac7a39a8896a7f78a20fe79758f146d2158f2fc529e51ac705720a745552770 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in eth-react-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387 The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main...

Malicious code in anhn-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657 bin/install/install.js appends a heavily obfuscated top-level IIFE obfuscator.io-style rotated string array 0x240a/0x4963 with arithmetic index...

Malicious code in node_cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e10a704c94a9f7a4f6344a67e3867cd87b21be574e81bbdccdc6b5ca48f65a2 The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging callers to pass cryptographic or wallet material to i...

Malicious code in ranux-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f package.json declares the dependency @whiskeysockets/baileys but resolves it from github:rcedubot/X instead of the npm registry. Installing ranux-dev...

Malicious code in plugin-react-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c068ede55759ccbff349be0990eab7756ca43a5eed8a60a805e69e8c32626a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

Malicious code in autoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43e2f80495807b8e77521a7d5bcba68a0ba790db0ca08a3d14450f568165217d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in upload-to-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...

Malicious code in @velliajs/discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d The package presents itself as a discord.js clone repository field points at the real github.com/discordjs/discord.js.git, README instructs import...

Malicious code in @mexc/shared-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6d793d1ff65b7f5a24e1aa0c176eaa5d83c7870e05cca5b64f22edb9ca7ded7 Package published to the public npm registry under the @mexc scope without evidence of scope ownership. package.json declares a postinstall hook...

Malicious code in @lodash-js/lodash-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency...

Malicious code in @ferudionz/web_logger_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42924eef53202ac8b42a142da91ff30445dab53dcf185fa4798efd4d40d1b095 The package ships a single obfuscator.io-style index.js with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug...

Malicious code in @divineubg/divine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52dc0a48d6e7e18ff3bb09306aa6d4c17aefff323b1f86b84f19197ba4a094be index.js exports a listenclientId function that subscribes to https://ntfy.sh/dv-141u30-admin-cmd-/sse via EventSource and, on receiving messages wit...

Malicious code in alelo-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5aceecfb22fd66b4e0861399aa6864ba19a983f3483294dd0740e7e24d1c34 On npm install, preinstall.js collects hostname, username, platform, cwd, and the full process.env and POSTs the payload over HTTPS with TLS...

Malicious code in @veertly/web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 356a8a00db1082e33357c6fa0bd625070977f72964236e992e1be94dcd419764 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wct-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node.js version,...

Malicious code in root-locator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2028000ac5395ba0f5ddda0c3d9003770de8f14847dd2cebaeb04031bbcf9ce8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @khaznatech/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d6d321090b3f66b7766ca73a5cebf1a2d3ab2908d8d31f8423616c8094ec0a8 The package declares a preinstall script install-report.js that runs on npm install. It reads os.hostname and the current working directory basename...

Malicious code in prediction-trader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87 index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch variables named iconDomain/getPlugin,...

Malicious code in npm-hex-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0f1f9004b6a502c144d4d475e89a3956905aebf51fb2696d4ba05c21613727 The package's postinstall runs runtime.js, which POSTs os.hostname, os.userInfo.username, os.platform+os.arch, Node version, and OS release to...

Malicious code in @caspianph/second-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c167d81cfacb0675a51ad6d83fcf2960324cf66f7c506a725fed48c8023c8d77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ts-enum-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f362b9a6fbb2e117301be8a8195f14b6fa8481e3dcc3b37faff3d6eb111b0070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-kit-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb45cf2ae29595bdddd78ba81f4798842b6caf4cefd8abfcbad23f1eb812c3be The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcd9bc9e9217d04d7194f72655188a2a827bf5cfdb888693d98a15f2434225e4 Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinstall node callback.js, and...