Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

Malicious code in autoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43e2f80495807b8e77521a7d5bcba68a0ba790db0ca08a3d14450f568165217d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in upload-to-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...

Malicious code in @velliajs/discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d The package presents itself as a discord.js clone repository field points at the real github.com/discordjs/discord.js.git, README instructs import...

Malicious code in @mexc/shared-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6d793d1ff65b7f5a24e1aa0c176eaa5d83c7870e05cca5b64f22edb9ca7ded7 Package published to the public npm registry under the @mexc scope without evidence of scope ownership. package.json declares a postinstall hook...

Malicious code in @lodash-js/lodash-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency...

Malicious code in @ferudionz/web_logger_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42924eef53202ac8b42a142da91ff30445dab53dcf185fa4798efd4d40d1b095 The package ships a single obfuscator.io-style index.js with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug...

Malicious code in @divineubg/divine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52dc0a48d6e7e18ff3bb09306aa6d4c17aefff323b1f86b84f19197ba4a094be index.js exports a listenclientId function that subscribes to https://ntfy.sh/dv-141u30-admin-cmd-/sse via EventSource and, on receiving messages wit...

Malicious code in alelo-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5aceecfb22fd66b4e0861399aa6864ba19a983f3483294dd0740e7e24d1c34 On npm install, preinstall.js collects hostname, username, platform, cwd, and the full process.env and POSTs the payload over HTTPS with TLS...

Malicious code in meualelo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fdf84c3f49f6d13b7ccbed745056f8bf03c4c7a2b814152962361ac07bd4191 The package's preinstall.js collects hostname, username, platform, cwd, and the full process.env, then POSTs the JSON payload over HTTPS with TLS...

Malicious code in @veertly/web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 356a8a00db1082e33357c6fa0bd625070977f72964236e992e1be94dcd419764 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wct-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node.js version,...

Malicious code in root-locator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2028000ac5395ba0f5ddda0c3d9003770de8f14847dd2cebaeb04031bbcf9ce8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @khaznatech/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d6d321090b3f66b7766ca73a5cebf1a2d3ab2908d8d31f8423616c8094ec0a8 The package declares a preinstall script install-report.js that runs on npm install. It reads os.hostname and the current working directory basename...

Malicious code in prediction-trader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87 index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch variables named iconDomain/getPlugin,...

Malicious code in npm-hex-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0f1f9004b6a502c144d4d475e89a3956905aebf51fb2696d4ba05c21613727 The package's postinstall runs runtime.js, which POSTs os.hostname, os.userInfo.username, os.platform+os.arch, Node version, and OS release to...

Malicious code in @caspianph/second-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c167d81cfacb0675a51ad6d83fcf2960324cf66f7c506a725fed48c8023c8d77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ts-enum-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f362b9a6fbb2e117301be8a8195f14b6fa8481e3dcc3b37faff3d6eb111b0070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-kit-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb45cf2ae29595bdddd78ba81f4798842b6caf4cefd8abfcbad23f1eb812c3be The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcd9bc9e9217d04d7194f72655188a2a827bf5cfdb888693d98a15f2434225e4 Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinstall node callback.js, and...

Malicious code in @years18/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16d7ce451e7cdf1d3486a22c2ec25e3f56651ce45e132178839e2283918183f The package's postinstall script callback.js and its declared main entry index.js, byte-identical to callback.js fetch a tarball and a get-pip...

Malicious code in egair0810 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2778f49499126b52d7dc9bbf728ed62bc8177ea325300c7907f2a4b854436507 The package contains a single index.html file declared as the package main, presenting a fake 'Just a moment...' / Cloudflare Turnstile page with...

Malicious code in xcnvjfsiewlk9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062503dc8980c1ade02ac4fc0566a94d40b85c0a634da8b00a941f9acfcf9747 The package's sole content is an index.html disguised as a Cloudflare Turnstile 'Just a moment...' verification page. The HTML contains...

Malicious code in bs58-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d59b2d561269e6779eed82e12abe726403e9a2419936c01a4deaea9c3e70b2c Package bs58-12 presents itself as the popular bs58 base58 library README copied from bs58, advertising npm i --save bs58 but its own code is a thin...

Malicious code in camelot-ammv2-periphery (npm)

camelot-ammv2-periphery is a malicious npm package that impersonates Camelot DEX's AMM v2 periphery contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true...

Malicious code in fsbrowse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7866973ba5f2971efedd027cce57aefb5b8f27d7304de323261832c29bbd82 The package's main entry file index.js contains a legitimate Express file-server module followed by a unicode-escape-obfuscated IIFE appended after...

Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd82004d1cbf2e4b6a3c77f48293b0d9638fe59592eb40291b6a332121f6fe6 Package contains no code paths that read installer secrets, fetch and execute remote content, relay caller data to third-party destinations, or...

Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in localization-fixer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701 On require of the package's main entry, a top-level if isServer syncLanguageSystem fetches a JSON payload from...

Malicious code in sme-rko-finance-front-operations-other (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c11dc6f375e9ceaee8f1b8e40db07f49c88e7bc47715759b101d3513399047be On require/import, init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames...

Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under...

Malicious code in sme-rko-finance-front-operations-widget-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a On require of the package, platform.js and lib/telemetry.js run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one...

Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...

Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b21f700cd5e3a5eb33a34fa9e3a9754e73e5794ee1cc57ada01344004a8c921 index.js unconditionally loads runtime.js on require. runtime.js detects the host OS and architecture, then downloads an opaque platform-matched bina...

Malicious code in sme-rko-finance-front-operations-penalty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887 On require of the package, runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames...

Malicious code in aclade-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported...

Malicious code in yakuza0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9952a92dd18e2353ebb4f2d8064884e7be770d23770096af6dbe1844d8b5fd6 The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjbill.ren, from cli/index.js...

Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

Malicious code in dolyame-ui-inputsearchtagged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9880fbbce0555f24a1b8910b6271c9b74bd210c1e2aad74bee6ef21338c2eff3 On require of the package, init.js selects a platform-specific payload, downloads opaque bytes over HTTPS from a rotating set of anonymous Cloudflare...

Malicious code in dolyame-ui-datatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains...

Malicious code in dolyame-ui-inputphone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85087183768e1521c6facb6dc1f2fe1c838d7f57b8a6a8382bbcee4ac70d165 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from a set of Cloudflare Workers endpoints...

Malicious code in pydanticc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bc3a091548db52bab3bf8556e95780b3041aa971b6353d7f31bdb71128915a1 pydanticc is a typosquat of the popular 'pydantic' package. Its setup.py defines a custom setuptools install command whose body is stored as a base64...

Malicious code in @diezyyasha/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd6b728a9ecc8547f7199d74cfc1070334a586f5fd7fed6e87e332b70945c733 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ccfly/setup-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8 The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty PTY spawning and...

Malicious code in @atom8n/inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c This @atom8n/-scoped package impersonates Anthropic's official MCP inspector package.json declares author 'Anthropic, PBC' and homepage...

Malicious code in @addai/node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca685518d56ea513609a2dfcd845bb14d94c3faaf58645553c688ca59817921 The package installs a background daemon dist/session-runner.js that pairs the host to a remote +Ai account and polls a hardcoded Supabase backend at...

Malicious code in typst-resume-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 104d03639d9a9d48d03641fef83163391bb1540c8a01c56287bcaf8ca45ad01c index.js loads https, http, and childprocess at the top of the module and sends host/environment data to a hardcoded AWS Lambda URL at...

Malicious code in agenthub-multiagent-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a agenthub-multiagent-mcp ships a worker dist/worker.js that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/ and, fo...

Malicious code in helmet-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402 [email protected] is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawn...

Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...