Malicious code in iceberg-javascript (npm)

Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...

Malicious code in 01-0redi7qgbz0uv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ceb633970757ab5d5ee0b64512c18d46be8402ac2169769101655a697ee5d6d the analysis found that this package has a garbage randomized name '01-0redi7qgbz0uv', empty description, placeholder test script, and an index.js th...

Malicious code in @tanstack/react-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 006982dd9591684fdcea74c0b70c7600a22bfc969bac6b9fb64f728e7ab34d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tanstack/history (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d40d7bafa18dd8987c0ee75b8ffccfc7db076f4521961472d0830ef93a03994e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tanstack/eslint-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff80f01eaa71625ecdc195880a0c0f1ef71da7fa81d01422abf9634f74b5d6be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in openai-spellchecker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 13911c4c1e0334b4e4d972e3b3256a08f8991d3935d74086c252ed085d3984a0 The package hides code to download and execute a next-stage payload, which then communicates with C2 and listens for next code parts. In the analyzed version,...

Malicious code in web3-py-checksum (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4b2052172f5c854b2e91f6bdc9336a97469cd161372621a1880d9cd1e3ad426a The code silently exfiltrates the private key of a crypto account. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in justinleaguekems (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 039b35e6547b64dd3e28ba9e178b9716447f88d6bd9558766c9ffe8850262d99 Package exfiltrates screenshots and network information to a hardcoded target. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in eth-web3-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ab01b68589d4f3b1e8686ed007d522f24c8259049cb211a023ac3f3ff8f56ce4 Code pretends to be an ETH utility and exfiltrates the given seed/private key --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in camelotlabs-core (npm)

Five packages camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry at version 99.0.0 by the actor madman0619 as a dependency confusion attack targeting the internal npm packages of Camelot Labs. The inflated...

Malicious code in money-badger-open-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9d70a5231934ee14ab33334a3de0db40d5520fb4ef092a5a24cbdffff9751e The package money-badger-open-rpc was found to contain malicious code. Source: ghsa-malware...

Malicious code in forge-jsxy (npm)

forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and carries an identical fake description 'Node.js integration layer for Autodesk Forge' to impersonate a legitimate Autodesk Forge SDK. The package is a fully-formed RAT deploy...

Malicious code in ally-allowlist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a086e259ec0972dac4c5fa5c2e204b09c2158df4e01326321b84676837b85be9 The package ally-allowlist was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in currenttimerpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ccd5c81889e68b6ae8a0e8ef90b7c3a4dc447b08872ad6ac48ce94804985379d During import, the package automatically downloads and executes code that first acts as an infostealer and then starts code acting as a RAT. It connects with a...

Malicious code in bpmn-studio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74f940a81cf83fdce38d48caa8f864ae59438b6854a16c28b78c618441be28d9 The package bpmn-studio was found to contain malicious code. Source: ghsa-malware c4094042484c2fe0da68df30936b7782a5624bfd8c82d3ed8759a3ce66440a61 An...

Malicious code in path-internal-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaba59a63a7a6f3dfc734a55082dff17dbf357f41b2a09ef0c87f73d046088e1 On require, path.js executes an IIFE that calls loadTokenData, which fetches a base64-obfuscated URL decoding to https://www.jsonkeeper.com/b/CWOV9,...

Malicious code in emergentintegrations (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fce023cdc4fa1509dbc8512d9b3728d4f5944941a522f63b94ef27b764ee4fbd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in chai-as-inserted (npm)

chai-as-inserted is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint.io/ef2875f70e59e319189d and executes it similar to malware in to chai-await-test. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

Malicious code in bitu-staking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adb12160da2b84d2f9c21c6d5f3a2d803e574fcf593e9d84da3b5e8cbbdef96e The package bitu-staking was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in mattermost-airflow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 667be9d0c5eaea7acdf1c2593165304280ef7b67bfbf4d8c0f36065836fe834c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in remitly-blog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dc307937a69a928785741aaf42f1e0e6ddea72dd3d7f7919c4ca4864d9835b4 The package remitly-blog was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in sky-enablement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9712856e1dd6e76d395507a76c21d01a945d4e5490e0d747384212a4a8b7c6df The package sky-enablement was found to contain malicious code...

Malicious code in react-query-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bce94f40a0e1879b184cd9f5abb5f4850d66aa5705b231b41337c2e2e33a3de The package react-query-core-utils was found to contain malicious code...

Malicious code in react-performance-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8467a722c92d3c846a99ea30e0b092dd93fba781c34f93dae9b05582d4475e The package react-performance-suite was found to contain malicious code...

Malicious code in pkgnewfefame1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 784cb2a0a3df5c95ee2f3f5b348780d29ffa4e6d03263d5611531f0b6babe20e The package pkgnewfefame1 was found to contain malicious code...

Malicious code in phx-core4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f34a66abe0d68aa9e9250d5fea5c5a537be067859159164a917c667923d51d0c The package phx-core4 was found to contain malicious code...

Malicious code in dotenv-mono-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e4774845081c77828c11c246f1224738c74e91df84182defb19b32ff6a8757 The package dotenv-mono-cli was found to contain malicious code...

Malicious code in test6789.latest (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in cortana-md-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 686dc6172d061151a94189d41cd564a6127d00f10af75880962a357301ec135e The package cortana-md-bot was found to contain malicious code. Source: ghsa-malware a712b3a56136d272ebf1a688ff9ea1cc572023730622963df1e6e82389177d28...

Malicious code in immer-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bc0710eb5a0ad9d9eb01cbd2d6f7c1b9cc39b07636d82a05f2cafdf953756bd The package immer-js was found to contain malicious code. Source: ghsa-malware 920c7d161c9e90ea35c168d53dd01e0920704e5f35e76d330fac6fb3c0a2cb87 Any...

Malicious code in jaetut-varit-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e85e1a4defa66ffea068e9c6df340133d21686f29ad138d73976ff88d60ef368 The package jaetut-varit-test was found to contain malicious code. Source: ghsa-malware...

Malicious code in link-theta-float-class-balance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0217fbc8ce82958f98e07fb84597a7fb29c01d324de938f4aca90bcef15b747a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in roti16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839bd37cb0af6379dbf75974527bceab813a0506658799cb6f187b054d51472f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in digo-kamoli-ailasoml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e850873148b5bb8dacac08ace2faaf7478b27680811e61a36adfd1454a59fc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in monolith-twirp-features-actors (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis af5da19cc088c1f8c8715fafba484c4ae7ab890004b1f92947ee212b28b0abe1 The OpenSSF Package Analysis project identified 'monolith-twirp-features-actors' @ 1.0.4 rubygems as malicious. It is considered malicious...

Malicious code in penguin-lunar-pw29 (npm)

The package penguin-lunar-pw29 was found to contain malicious code...

Malicious code in ledvance-living-style-guide (npm)

The package ledvance-living-style-guide was found to contain malicious code...

Malicious code in neo4j-apoc-procedures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ae32122ca71a7a075fce5993dbcdceca009308664157c1655b4b3897e205f3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gps-gateway-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7841067a161c55356141a3d1e9fb8bd1922ff25291edeb0d46e708a9e6b563b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in imran-downloader-servar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0ed3c408311c79c6c881bf500f227a981d7cd2c0908cb00a0bd010e9d5352bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dwt-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71538fff3798a2b42ad1f28f2cbd053e501b0e143b563f0334e005a1ed152e24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in Be.Vlaanderen.Basisregisters.PrоjеctіonHandling.LastChangedList.Microsоft (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in flask-angular (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in telia-common-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfebd0cdbe7eb17494bd4125767a79da7343f06e4fbe26c09d95f7b94e123f8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alibabacloud-ecs20180317 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8af47576c10df6b4eb3fae145ce469e9ef394691bde6181e0fef25dbc8358f7a Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

Malicious code in bitcoinjs-lib-bigint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee5abe0014de83de3d111ab01e42e93f93afb0456186973c93615ac2bdcbcd00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sliding-score-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e2a97d5dd3e10080ee69201bf757ea14ebda90b9da1be41392584152ad1f1d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in company-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud...

Malicious code in env-validator-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964 The package ships no source module only egg-info metadata despite declaring a consolescript entrypoint 'env-validator=envvalidator.cli:main' that...

Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...