Lucene search
+L
OssfMost viewed

235890 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/06 6:23 a.m.26 views

Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

5.6AI score
SaveExploits0References9
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 6:48 p.m.26 views

Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52851f17c7c1a340dd9999cf89369ffffd6fbe5bac9aa1b441bdc42ce320067 On require of this package, index.js loads compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 6:17 p.m.26 views

Malicious code in @cliphijack/santaclaude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a4fa42a55635225fb914eaea97cbc9699efb6cc197445eacf32e6592b60675 The santaclaude bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls /api/control/claim. Messages received from the...

6.1AI score
SaveExploits0References7
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 5:48 p.m.26 views

Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

5.8AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 5:35 p.m.26 views

Malicious code in test-dev-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108 src/config.js hardcodes a remote host as the English-word phrase "Four Five P Nine Five P One Eight Six P Two Three Seven" and decodes it at import...

5.6AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:38 p.m.26 views

Malicious code in chatcc-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a69e686f3f793120840abd296a10a4b1c8d734797607e7dce82a82e90cf7cf0 chatcc-agent runs a daemon that connects to Tencent Cloud IM as a WebSocket client and treats inbound peer messages of type 'terminalcommand',...

5.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:38 p.m.26 views

Malicious code in bigops-insite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe91d01b6f87752714ea87b8c79ecdda9497faf4a99709118330640cfaf46a2 On require'bigops-insite', index.js top-level loads./setup.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomain...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:37 p.m.26 views

Malicious code in bigops-microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789 index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays oob-worker.cf99-9b3.workers.dev,...

6.3AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:33 p.m.26 views

Malicious code in bigops-storio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:33 p.m.26 views

Malicious code in bigops-storio-ngrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:31 p.m.26 views

Malicious code in devplatform-test-pvm-is-even (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab114c230ec1d462306a74f0eaaddf32474b1fae0087e1038ab2e280637d558 The main entry index.js requires./runtime.js, which at load time assembles hostnames from split string arrays e.g. 'oob-worker.cf101-adf.workers.dev'...

6.4AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:30 p.m.26 views

Malicious code in devplatform-supafetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally...

6.5AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:28 p.m.26 views

Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

5.7AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:26 p.m.26 views

Malicious code in dolyame-boxy-atom-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb29bd9c1d233b882994262382b5f0b5b21cb2b868c139720d5ec9533ce9301 On require of the package, index.js loads helpers.js which invokes setup at module load. setup selects a platform-specific payload path...

5.7AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:25 p.m.26 views

Malicious code in dolyame-boxy-atom-icon-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766 Package advertised as an icon loader but on require the bundled vendor.js downloads a platform-specific executable from obfuscated Cloudflare...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:25 p.m.26 views

Malicious code in dolyame-boxy-desktop-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc On require of this package, index.js loads bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembl...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:23 p.m.26 views

Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:23 p.m.26 views

Malicious code in dolyame-boxy-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:21 p.m.26 views

Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts...

6.3AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:05 p.m.26 views

Malicious code in devplatform-vite-plugin-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from ...

6.2AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:01 p.m.26 views

Malicious code in bigops-tinkoff-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cb54c5f503b1cad2b4ae932f592d8870df743b1c1b6b029616343b65f6ae09 On require of the package, index.js loads runtime.js which fetches a platform-specific binary from Cloudflare Workers hosts...

5.7AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 3:00 p.m.26 views

Malicious code in bigops-watchdog-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7bfa2b0d9464df6662fddb4e969b42ef35465f2c70ba39943ac3fb0265aa781 On require of the package, index.js loads vendor.js which selects a platform-specific URL, downloads an opaque binary from one of several Cloudflare...

6.3AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 2:59 p.m.26 views

Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 2:57 p.m.26 views

Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277 On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 2:56 p.m.26 views

Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 2:54 p.m.26 views

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 2:48 p.m.26 views

Malicious code in beaver-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native...

5.8AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 2:47 p.m.26 views

Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 2:42 p.m.26 views

Malicious code in bnpl-blocks-independent-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e5739a73a4f30d9828f08510a518df278f00214576e8c2aaea847bc536989bd The package advertises itself as a UI title component but on require of index.js loads support.js, which selects a per-OS payload path, fetches an...

5.5AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 2:41 p.m.26 views

Malicious code in bnpl-blocks-mobile-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c54195f215860087ea60839eed874351de1bf279c7a80d12c128214d3602b26 On require of the package, index.js loads./vendor.js, which assembles Cloudflare Workers hostnames from split string fragments...

5.5AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 1:49 p.m.26 views

Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

5.8AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 3:54 p.m.26 views

Malicious code in @qlik/sprout-icons (npm)

npm/@qlik/sprout-icons is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

6AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 3:47 p.m.26 views

Malicious code in @qlik/embed-web-components (npm)

npm/@qlik/embed-web-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.7AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 3:13 p.m.26 views

Malicious code in @ornikar/react-native-svg-transformer (npm)

npm/@ornikar/react-native-svg-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...

5.8AI score
SaveExploits0References14
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/31 2:15 p.m.26 views

Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...

6AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/31 12:52 a.m.26 views

Malicious code in vcse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23149b92d10aaf504452f58832dd63804e33639ceda81871c4188295d3d13117 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/30 10:47 p.m.26 views

Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

6.5AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/29 8:30 a.m.26 views

Malicious code in @finxsecdemo/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be118b4cf0acab2c331cc37f68a19bdbdf2ac8423ef984a1cac5c9f4d21c1e7e The postinstall.js lifecycle script unconditionally issues an HTTPS GET and a DNS resolution against a hardcoded interact.sh/OAST subdomain...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/28 1:29 p.m.26 views

Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

5.5AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/28 9:00 a.m.26 views

Malicious code in app-soda-layer (npm)

app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...

5.7AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/28 6:27 a.m.26 views

Malicious code in string-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...

5.5AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/27 10:02 p.m.26 views

Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...

5.5AI score
SaveExploits0References10
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/27 4:19 p.m.26 views

Malicious code in @heartlandone-private/fontawesome-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc8f9f53c05ecc2642ce82c3841e046025662c206f002b4c6da11ff0cbc763d The package's postinstall lifecycle hook runs node index.js, which issues an HTTPS GET to a hardcoded Burp Collaborator subdomain at...

5.9AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/27 4:15 p.m.26 views

Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home...

5.6AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/27 12:36 p.m.26 views

Malicious code in tailwind-motionkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84dfdf101e36c7ca60ca1a1e72d59a7893a5abee9bf359852cdeabdb0af2cd2 Review of [email protected] surfaced no evidence of exfiltration, install-time remote code execution, silent relay, credential distribution,...

5.9AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/26 7:36 p.m.27 views

Malicious code in random-ua-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 543206058a0b8e85c8227a0bfdd4752fc61779b24968a0bd5d50ae6b3040387b During import, the code starts a keylogger and exfiltrates data from cryptowallets. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

5.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/25 4:30 p.m.26 views

Malicious code in swiper_angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/25 9:24 a.m.26 views

Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27087d7e447aae7f5009468024ead0904a706c36775c9a132b43bbcd47d3993c [email protected] declares preinstall: node index.js in package.json, causing index.js to run automatically on npm install. The script...

5.6AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/24 9:21 a.m.27 views

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/24 6:42 a.m.26 views

Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...

5.5AI score
SaveExploits0References1
Total number of security vulnerabilities5000