Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

Malicious code in @cliphijack/santaclaude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a4fa42a55635225fb914eaea97cbc9699efb6cc197445eacf32e6592b60675 The santaclaude bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls /api/control/claim. Messages received from the...

Malicious code in clawtrl-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c The package's cli.js imports childprocess, https, and os, reads process.env and system information via os.tmpdir and related os APIs, spawns a bash...

Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

Malicious code in chatcc-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a69e686f3f793120840abd296a10a4b1c8d734797607e7dce82a82e90cf7cf0 chatcc-agent runs a daemon that connects to Tencent Cloud IM as a WebSocket client and treats inbound peer messages of type 'terminalcommand',...

Malicious code in bigops-storio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split...

Malicious code in bigops-storio-ngrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...

Malicious code in devplatform-supafetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally...

Malicious code in dolyame-boxy-desktop-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc On require of this package, index.js loads bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembl...

Malicious code in dolyame-boxy-desktop-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241 On require, index.js loads./platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers...

Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...

Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

Malicious code in dolyame-boxy-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310 On require of the package, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary fro...

Malicious code in devplatform-vite-plugin-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from ...

Malicious code in devplatform-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from...

Malicious code in beaver-ui-pagination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8f562892f21caf2a12230c52507a333a5ada223f98964094838657072adcb On require'beaver-ui-pagination', index.js loads init.js which selects a platform key and downloads a binary from string-split-obfuscated hosts...

Malicious code in devplatform-spa-plugin-s3-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41 On require of devplatform-spa-plugin-s3-router, index.js loads helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflar...

Malicious code in bigops-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80be948322937758b568e63d82d769aa07a443a3b849cf19fd440ed5bf4505ec On require'bigops-tasks', index.js side-effect loads vendor.js which downloads a platform-specific native binary from string-fragment-obfuscated...

Malicious code in bigops-tinkoff-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cb54c5f503b1cad2b4ae932f592d8870df743b1c1b6b029616343b65f6ae09 On require of the package, index.js loads runtime.js which fetches a platform-specific binary from Cloudflare Workers hosts...

Malicious code in bigops-watchdog-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7bfa2b0d9464df6662fddb4e969b42ef35465f2c70ba39943ac3fb0265aa781 On require of the package, index.js loads vendor.js which selects a platform-specific URL, downloads an opaque binary from one of several Cloudflare...

Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277 On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded...

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in beaver-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native...

Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

Malicious code in bnpl-blocks-independent-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e5739a73a4f30d9828f08510a518df278f00214576e8c2aaea847bc536989bd The package advertises itself as a UI title component but on require of index.js loads support.js, which selects a per-OS payload path, fetches an...

Malicious code in bnpl-blocks-mobile-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c54195f215860087ea60839eed874351de1bf279c7a80d12c128214d3602b26 On require of the package, index.js loads./vendor.js, which assembles Cloudflare Workers hostnames from split string fragments...

Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

Malicious code in @qlik/sprout-icons (npm)

npm/@qlik/sprout-icons is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @qlik/embed-web-components (npm)

npm/@qlik/embed-web-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...

Malicious code in vcse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23149b92d10aaf504452f58832dd63804e33639ceda81871c4188295d3d13117 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

Malicious code in @finxsecdemo/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be118b4cf0acab2c331cc37f68a19bdbdf2ac8423ef984a1cac5c9f4d21c1e7e The postinstall.js lifecycle script unconditionally issues an HTTPS GET and a DNS resolution against a hardcoded interact.sh/OAST subdomain...

Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

Malicious code in app-soda-layer (npm)

app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...

Malicious code in string-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...

Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...

Malicious code in @heartlandone-private/fontawesome-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc8f9f53c05ecc2642ce82c3841e046025662c206f002b4c6da11ff0cbc763d The package's postinstall lifecycle hook runs node index.js, which issues an HTTPS GET to a hardcoded Burp Collaborator subdomain at...

Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home...

Malicious code in tailwind-motionkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84dfdf101e36c7ca60ca1a1e72d59a7893a5abee9bf359852cdeabdb0af2cd2 Review of [email protected] surfaced no evidence of exfiltration, install-time remote code execution, silent relay, credential distribution,...

Malicious code in random-ua-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 543206058a0b8e85c8227a0bfdd4752fc61779b24968a0bd5d50ae6b3040387b During import, the code starts a keylogger and exfiltrates data from cryptowallets. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in swiper_angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...

Malicious code in whs4_eud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5 [email protected] declares a postinstall lifecycle script node index.js that fires unconditionally on npm install. On execution, index.js POSTs...

Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27087d7e447aae7f5009468024ead0904a706c36775c9a132b43bbcd47d3993c [email protected] declares preinstall: node index.js in package.json, causing index.js to run automatically on npm install. The script...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...

Malicious code in eth-codergen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dda2a0fbfa98304482ef90da4f137c863775959e107fccd495311fcba4fd185c The package is advertised as an Ethereum ABI code generator but its index.js is a verbatim copy of the unrelated mongoose-lean-hooks plugin. Appended...

Malicious code in streak-lib-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...

Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc009d2d22b9f02aa6b2cce1ac5eadfcb3f3a7d437cc2ba031eb1e6154da2a4 [email protected] shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, backdoor, or self-propagatio...