Malicious code in strapi-plugin-nordica-lite (npm)

strapi-plugin-nordica-lite is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network...

Malicious code in @c8o/nimbus-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8225c79aa127203c225df747705db370e11cfae184af100a063b2dfa4eb20eb8 The package @c8o/nimbus-core was found to contain malicious code. Source: ghsa-malware 23fd3197db4264e7b8ef6d65380e017c5b205b46a8e732df586feffcf3c7c7...

Malicious code in tailwind-compile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbf65c7619b6b53280e5b8466ad34ab144b9e6f1da1ab9a80fc621001cc380e The package tailwind-compile was found to contain malicious code. Source: ghsa-malware c6dd40384bf67bcd86f55c070ba74b522d8a9531dec334d4604f0b3737cd96...

Malicious code in react-native-forter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff4ae821a2636c10a3e19afaaf78823613bcedf143d91c79cbdec29f20b00654 The package react-native-forter was found to contain malicious code...

Malicious code in ctf-package-onetimeuseforctf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d37390fd81ab77282de711d615673122fd18763d31c720135595e40dd32a71b The package ctf-package-onetimeuseforctf was found to contain malicious code...

Malicious code in @pansycareful/github-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b0fd8e716dd8a1f3d3d8e33d9dfec9cee22ca3b511d7ac05fb3b175da1d1842 The package @pansycareful/github-helper was found to contain malicious code...

Malicious code in remitly-blog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dc307937a69a928785741aaf42f1e0e6ddea72dd3d7f7919c4ca4864d9835b4 The package remitly-blog was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in whatnot-manifests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f0504ddd24de9ec3870bb8fc657436f5a61e3f6327f0e044bc380bfe3479d40 The package whatnot-manifests was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in wiz-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be8c0c61ad6d8e5e76edbce5a6e053676767ed4dcabed1c20389db704cc20411 The package wiz-dev was found to contain malicious code...

Malicious code in smm-yt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d0a38085e1e5c5be475b6ae3387d915541a3aea8d1b8ac6869a1125f3c47d0d The package smm-yt was found to contain malicious code...

Malicious code in sky-enablement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9712856e1dd6e76d395507a76c21d01a945d4e5490e0d747384212a4a8b7c6df The package sky-enablement was found to contain malicious code...

Malicious code in safeness-sb-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9766c02e9c5a79f96104b5089c06ae16b472ff7734284462bd3bfe0fe3c4a687 The package safeness-sb-new was found to contain malicious code...

Malicious code in react-fast-utilsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95853c89c144cd1630b70c6d2c5e97e8b3cafd6d8ff628b357c80d6a7f8407b5 The package react-fast-utilsa was found to contain malicious code...

Malicious code in proleis-web-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bb886b0dde88d16ff59ed346f20f0b69a299a33070c16def5b659ba308a3e8 The package proleis-web-scanner was found to contain malicious code...

Malicious code in postcss-hotfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b4d8ad8f9c133d2d8680b4d666d442b455bbd1579dea5cd5582a883fc4f0b5 The package postcss-hotfix was found to contain malicious code...

Malicious code in phx-core4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f34a66abe0d68aa9e9250d5fea5c5a537be067859159164a917c667923d51d0c The package phx-core4 was found to contain malicious code...

Malicious code in @inter-ikea-gallery/integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41711fef02809de5ee632f210cfe1102fe06ee4273743b408ec9ae92d7cb9277 The package @inter-ikea-gallery/integration was found to contain malicious code...

Malicious code in test6789.latest (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in loadash-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8a6b55079998d38c9458ab6cae73e677bccc96d3965a9e6584e85c0450c2695 The package loadash-lint was found to contain malicious code. Source: ghsa-malware 9ad2a23ceb26c4b6ac051ac94acfa976eda403c11d9eaf9833d2b9206a5d2155 A...

Malicious code in ng-vzbootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da191c637225627fd72d8ac07b5358e97dad12fa37eb8cd67aaff06686d5fbd6 The package ng-vzbootstrap was found to contain malicious code. Source: ghsa-malware 8e3edec659665a66e3b038b43eef43aa20405b14a4b4d47323636a8e3ae352aa...

Malicious code in isb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 93750cbddba7897fde1d31836971e11082ad2076012c7caf708980de45827840 Starting the module initiates an infostealer with a Telegram bot and RAT-like functionality and hardcoded credentials. The code automatically adds itself to...

Malicious code in solhint-plugin-hyperlane (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5f1d66ba0771661e6786da7d4953af3fc1ff1e280d1c666abd1e69e481274747 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in anduril-lattice-sdk-grpc-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1baa043d99a594c81f1a153d2da1d69bc4a2e67181cdf491c2f06f65120089aa Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in nanoid-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad39f50bf85a03002a528aac3cf53797c47e72d196c7e0f9b92623e03088abf The package nanoid-js was found to contain malicious code. Source: ghsa-malware b20b5d4f24d425723aaaf45603909066d5983fe5341afba20f47d091f7ac0933 Any...

Malicious code in react-hook-form-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10977fa5366d3d6e71079dade6da0fd8f346f3ce1d9d769f9664a89bdc7d4fe2 The package react-hook-form-js was found to contain malicious code. Source: ghsa-malware...

Malicious code in umap-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fe0d08b117ec6e7dcd48b13025326c2f427f3251c624867c9f0d398bd2dab8 The package umap-wasm was found to contain malicious code. Source: ghsa-malware a8b9419bdb44fab11a3bade4b4831308972f0fc3acfd3472c362fe672339e8ab Any...

Malicious code in @lokeswari-satyanarayanan/rn-zustand-expo-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73fe3bd99e2f11ab8bb09a9086c4dca8af56372031492ed11d90f1e32a0e8f53 The package @lokeswari-satyanarayanan/rn-zustand-expo-template was found to contain malicious code. Source: google-open-source-security...

Malicious code in airbnb-react-router-legacy-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64d31fa6c9b6cd0a9e87216ce93110698b49f1fede30d3f090902284a5153613 The package airbnb-react-router-legacy-v3 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in plutology-release-it-despina-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52a749c6fc4371a3c2293723768a233f315f8ed6aed6c686b69a16951edb77c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gocay-guga-visagoigojhi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ba24826b7bdb486c617ba88e6f1ebdd88b9cfe97c3c7642be9b5254ae3c6c24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vega-library-schema-parcel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dcc95f4dea0db952210a246c97eca63e5bda6d4afe8728102b9082fb2aeeef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in websockets-vega-hyperion-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dc82e9b40a9dd105dc85816bae54c3df108092997744a8455a3dbd46a8b485a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-rojak76-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d9f45f45f49406f06fe02b9fa5151af604f5befab23d69271e29fde388fcd6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tsleep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed66f2b93e98b57d021fd0653e70765b4b209fdcd11df8fc84d9ef9081c32b97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @moonpig/web-core-utils (npm)

The package @moonpig/web-core-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Malicious code in kw-styles (npm)

The package kw-styles was found to contain malicious code...

Malicious code in darkenergy-unuk-barnard-package (npm)

The package darkenergy-unuk-barnard-package was found to contain malicious code...

Malicious code in exceljs-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 542e79c60c18aa779332620c884952b318f885c798a0ac8c2d3bf87bfad26950 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in realtime-from-scratch (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in azuredatastudio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f18b345dc494772b0800d6b81807d5d930ceb567876dab5d06e478d66f5cda77 The OpenSSF Package Analysis project identified 'azuredatastudio' @ 1.53.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in thirdweb-eats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e52053ef8affeeb1437d9466f547c38e3f7d7c1e6a9981ad530707cac1ae736a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bo3to (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 131072b5bfcd4ce6218aaec66423046b83d0e49904d5992b26192daa201421bd During installation, a cryptominer is secretly installed and started. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in psh-hydra-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7e602e73e004aedbd93e2617bee443de236f268346b5b57bd42fcd32669825fd The OpenSSF Package Analysis project identified 'psh-hydra-sdk' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in amazon-s3-data-replication-hub-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4ca6ae6edf3790eb5efb9ad36e153e033bf826c074090d9d9cb473b1c56b5d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in avito (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 754d4412e0c50adbdfbad633f62c8c1edb7c4405299a828af25e873130b1ce16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in inbox-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a50d075a7a6ae36d254356739efc2479c86410d6d8a614f29578c92baa25b7ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @harrysforge/product-displays (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9eafe38f8ddd5d76ad65b4588ae0ae643ca975cfdc3648300e1cd1bb05659a22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in microsoft-bonsai-visualizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af44fbbcf5f4c4b320b933ab7cc00323158be62a4c2d23be50f06265760b5a4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...