Malicious code in bitu-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in anguvarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angurarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angumarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulyrjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angulmrjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angularus (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angularrs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angularks (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angularhs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in anguearjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in angufarjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zwxbccab (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zwtestabc4 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zwkopt4 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zswactb11785 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zsvnjin2a18dd (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zrzx5c3cc9 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zrzx407894 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zlam_httpsno (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in xla21778568189 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wp887 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wenc10385 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandproxy2 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandczvof7git (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vcsmodpdfx1 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vand5kbjt1778552578 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in uuext4c477b (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in tryd2zz (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in swpdf131119fos (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in swcaltesta (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in slwsvn7762 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oakmi17200 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaipobdflfoog (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lp124 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in express-firegate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9296b130c2fc6d2ff1821380cd4320e95ccc2605577a5ff2aa1e93e628aafc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in renderctx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbdcdb9e0c6002d228035d5d746f734a23c224429a18e078a44e5fa65db495f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @flex-ng/error-component (npm)

The @flex-ng/error-component package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the...

Malicious code in gen-ai-opt-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3653831a01d3068b12688a9f6ae11926a1b1edde27f8f37a6c48f3f0dba99231 On npm install, postinstall.js executes automatically and collects installer host identifiers os.hostname, os.userInfo.username plus public IP/geo da...

Malicious code in httpprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb46b890b54f51f3a98c1935dbd50e143430757c5daf4080039d32865b04c1d5 The package advertises itself as an 'HTTP probing tool for security researchers' but contains no HTTP-probing functionality. Its only behavior is to...

Malicious code in bytekit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbaea22b635a4a8425964572b733b806f45714a9090492d1c39d545088fe336 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in haproxy-config-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f86ffde45262c5d45a24458a85116ab5ca80451ce3d3159f9d7cad6599ad145 setup.py registers install, develop, and egginfo command hooks that run a routine which XOR-0x5A-decodes a list of attacker-controlled Cloudflare...

Malicious code in test-pkg-x0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d0014944456f668a25fa484bf7cb5f36a7128d6a585b86d9294d8d49b23049a Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branches on uname -s...

Malicious code in polymarket-trading-developer-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...

Malicious code in vega-lite-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c98ee24f91eaab2bc8360306a75519ae167dcbc3c7bd38cc395fbaa9590f4cd Package name impersonates the popular vega-lite library but ships no vega functionality — only a preinstall exfiltration stub. package.json declares...

Malicious code in vitest-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e0165cbb3d6ed37a96889c4b016463706346e1c09413635c31ea1ceedde8774 The package's postinstall script node lib/utils/index.js spawns a detached, stdio-suppressed Node child process that runs...

Malicious code in ecto-corsair-flag-7kq3mz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on npm install. The script...

Malicious code in thirdwb (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. thirdwb is a typosquat of the legitimate thirdweb package. It uses a side-loader technique, pulling in log-taker as a transitive dependency; the infostealer runs automatically via that dependency's...

Malicious code in @druidsoft/botframework-directlinejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34ac6d117d0531ed668bd8df71233c07089b14c644a9403ee479976d75951fcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pvd3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c992d4bd87c36aa389d168c263ca0b89c04b425b0483217ae1098a0c2f3ee10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...