Malicious code in scw-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e609dfddbc549c740b78ea2dfcc4dc218584bdb695d1967e49e262c3ed2fb8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ocfe-tv-subscription-center-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b1dcb639402e9d94a5f6f171e32ed97eb7064f7a557b1f7382bf832a4415ba Package name resembles an internal-scoped name and uses an implausibly high version 9999.0.0 consistent with dependency-confusion targeting. The...

Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

Malicious code in @domyjs/mask (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95227ac866633c8dbcb549843c31a2e58dad0d69474e065b8ec7f09fbf9bfe71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-tqr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a86833e5a36c88fc9e53ced45f2d6d0ec40357cce7377aeec0da7e1f25666ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chartkit-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 888ecdd39e3a032c1b16877250049ae7f99e7eb523c5a55ae2c06080c343da97 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in metricboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a511a75c8c42dcd677dd3814265d3befefa7f339bdc6b0336788635813e837 MetricBoxLite 1.0 collects the installer's username getpass.getuser and hostname socket.gethostname, JSON-encodes them, and POSTs the payload to a...

Malicious code in tpu-raiden-jax (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37dbb20f91d6812bd5bcfa84a040595ea1f9358e56f946da4efa599f7751bed On first import, tpu-raiden-jax's top-level init.py invokes a canary routine that serializes the entire os.environ dictionary along with...

Malicious code in astlsi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222a62d677f99497f67476b9cc87886c05fb2a08827430934fb518798abb8339 The package presents itself as a proxy health-check utility, but its exported starts function walks /storage/emulated/0/ Android user-storage, collec...

Malicious code in taskforge-9xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40 The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server , fetches bytes from /api/x-handler and pipes them into a...

Malicious code in 2nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d The package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^SECRET|API|TOKEN|KEY/, JSON-serializes the...

Malicious code in easypanel-ctl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7 On npm install, the preinstall lifecycle script collects installer host identity hostname, username, cwd and enumerates CI-related environment variab...

Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

Malicious code in prime-coding-agent (npm)

The npm package prime-coding-agent is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. It is a pure-JS proxy dist/index.js: it reads the developer's provider API keys e.g. process.env.EXAAPIKEY, NVIDIAAPIKEY, configured provider...

Malicious code in 0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78 The package name '0requests' is a one-character variant of the popular PyPI package 'requests'. On import of the top-level package, init.py enumerate...

Malicious code in dsh-waste-market (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff08b82d3f992d5249efc4a0914c649542386b248af94f4aea510abc51dad0d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @quantixfinance/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a @quantixfinance/[email protected] ships an inert library body index.js exports an empty QuantixSDK class and a createClient stub while its preinstall lifecyc...

Malicious code in @quantixfinance/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497edc9bba37d0fd2fb3de0fccd537904ae37848535519f4d334c38d8b59d3bf The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings key, secret, token, pass, mnemonic,...

Malicious code in @quantixfinance/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3 The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords key, secret,...

Malicious code in @quantixfinance/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains...

Malicious code in guci-wxrout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bb83d0fbcc9d1cd163b94168217fbe3cbe5a6bd365af14d47da094eeb7a1400 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fullcalendar-windos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 942f89203237b7bb1f918d607864784dc6337b97df3fb598dda116c2b04e2370 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @viertechjs/wb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf0b89516ea99431b2f9d6629a3418779813f156d84bb4f3018dec0707b04a6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in react-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3486f0a140ab65c516d0261fefbe67384d5a604715ee6faa7da5591ab456b906 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/term-reqable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bede455ffb8df248983dc819abe214260d4d70582e54f60c9cf99e974f3bafa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randomunblockedwebsite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b83fc58e6f99c840f46ca2ee474746a519a2047d1b3af82c3381e664205982f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in kendo-angular-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 012a21168890d2cc7482e8f4191dd4d1ee848314bdf7bc0970be32fb87a7ef25 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in spc-grafeno-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2 The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, ...

Malicious code in @pipi596888/ccursor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in selfsigned-certificate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26324f10054a4b02e6d50af8f5373115e113a01c37d636ed70df2be1dd1b6b92 index.js contains a hidden code path where calling the library's generateCertificates API with the value 10 triggers loadSampleCertificates, which...

Malicious code in fuels-versions (npm)

The package 'fuels-versions' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d9f8a553c586813518fefc4735aa6ee3416720489a27c83b8eff10c1a6a755 bin/cli.js contains a hardcoded out-of-band callback URL at...

Malicious code in aura-instrumentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14004b53bc245039cad1473ab4a95c2b2c8fcff2acc4b5f2c0f868da63e103bd package.json declares a self-named dependency 'aura-instrumentation' whose source is the bare URL https://repo.securityctrl.com/aura-instrumentation...

Malicious code in gridster-coords (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245882b881fde3396fcb6e1e14f8b0014fc64cd1d02d27f101c8fd2a0b16c944 package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridster-coords instead of a...

Malicious code in amplitude-session-replay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb71ca2dc9e74e42a64b1533ecb98ea1cad26e283b0c3d3ba0f4e7c760fac713 package.json declares a dependency whose key is the package's own name amplitude-session-replay and whose value is a plain HTTPS URL,...

Malicious code in calcboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 227fe04d85516bd5348dea2c0c25078d057eacb4f439fd6a241ea0409b7afd09 setup.py and calcboxlite/init.py both invoke a top-level report function that reads getpass.getuser and socket.gethostname and POSTs them as JSON to ...

Malicious code in 3layerdipstackm7mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac848ba661287ba28da0b3cc4784738bad4003683b89af912b65cdc636db9b5c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackoj4nf9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 968e6bdb11b4ae272e4d6e1aba1ea5e06d56e607a5ff9b93969936dd0bca2c48 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstacklgszmx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326a185f0d36a9b1db29c212632e52f5f0e0105597b0b44e345d805871d41edc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackkrgcjq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c365be1bc5f3241edc2e2aeb5f9c28cf6ea5dbaa13d255cf9b104f68ac8b7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack5zhcdq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4ea8b2caa7385ff6deaae43cbbc3720f91dd3a8f385b0314ced03048d070923 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackdanp80 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7ad51aca2a1256c94902657616735d1f145c72f449b0beadf0fd3f3ccd6fd1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackrkxyr1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2531bc57919ce75f018da4d6a17d90c972a5141255d11b202af2952c81bb7fd1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackjj1l0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 802aadaae3993d59085710261543816ec373731aae53abd0988abb84bcf16d29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackvd6za6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df33424d0e368279d7040fcea1ffea1f222f3bc4433adf9801b323c6836c3ada The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackolosqh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4f942b352834f4f09c04a8cdd6f51090279709a01f209d38bc8e7cb731ab27 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackpmrxi4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad393deb6e86fe83b0601a3461ebfdecdb15c00cb4568c83d957cb875e9c224 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack1igc1l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f377c60953bae14cc75545afcab2dfdaff56f29f0f13abc7424ee4a163505805 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackkaw1i8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8a481301975d70f149e4948a37b36cbe5e70ac46ada2e81c66b17215332b538 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackoue8uj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbfd6cf0dd51a08702b2c92a405f75333ccaf8e90ad65b9f733e1db423513240 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackaawov4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 704460bfb28f3f2eb62cf3aed417be9a34fffa2545e9910f3ab5bbb127fc6547 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...