233163 matches found
Malicious code in tilaver-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...
Malicious code in solana-web3-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0 Package name closely mirrors the widely-used @solana/web3.js Solana SDK while being published under an unrelated, unscoped name. The bundled...
Malicious code in solana-web3-fork (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 912cb41aa6b78cf62207dbf95f7d6247238483a800fa9bc6edd9b9d9f7819364 Package name appears to fork or imitate the well-known @solana/web3.js library. Bundled files lib/index.cjs.js and lib/index.esm.js contain...
Malicious code in flow-eslint-oxidized (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @public-for-cdao/deploy (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @public-for-cdao/backend (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @irys-solutions/odesa-main (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 525ae6b33885c1153dac485b830c8977b433ba4cdd2cc9556415b146ed801569 No malicious behavior was identified in this package version. No lifecycle scripts performing remote fetches, no credential reads, no exfiltration...
Malicious code in @dxcl/transaction-js (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @gocortexio/npmgremlinbox-eupl-3-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef5d1488a7448aca043f2c93fd927103279b86134ea8a25e3f86ae29aaa11003 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @gocortexio/npmgremlinbox-gpl-3-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d75b3bea311e8ca772f732c1208f6646e548fd96644c1ee02c3ae4df695a2f67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @gocortexio/npmgremlinbox-artistic-1-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a54621aca82e78e4ee4adc57b3925274a0c7bf3b2d11d6d5af655c584de7fa45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in markscan-utils (npm)
The markscan-utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...
Malicious code in twilio-platform-request (npm)
The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a private...
Malicious code in @akrai/core (npm)
The @akrai/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...
Malicious code in aftermath-finance (npm)
The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...
Malicious code in iphouse (npm)
The iphouse package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that ...
Malicious code in twilio-assets (npm)
The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...
Malicious code in node-as-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 616f74a5722026c25913e644651f1edc57ccb3ca2a6145c1543ff802b3b883b9 On npm install, package.json's postinstall hook runs node test.js, which loads index.js and immediately invokes two harvest routines. The first...
Malicious code in twiliobox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a94eb66c6d3f03cf5b4e2e13527b9ab9bcb1ae85e75b62f79f58e225b941970 On npm install, [email protected] runs its declared postinstall script node.init.js, which enumerates credential-shaped environment variables NPMTOKEN,...
Malicious code in nodemon-elint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa [email protected] copies the source tree, README, author metadata, and homepage of the legitimate nodemon package but is published under a...
Malicious code in hehehee (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...
Malicious code in polymarket-math-stake-kelly (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to...
Malicious code in node-sysmon-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 612887c8528ff96b3bc3a61d678b6376099480c080d2d8a0960fe7798ac25f33 On module load, index.js reconstructs a hex-encoded URL Buffer.from'687474703a2f2f3135322e35332e3132302e39302f636d64','hex' that decodes to...
Malicious code in abuden210 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368c280a0e86d6d687aa5789a4bca9daeacd64666dc6954dd729a7549f506a59 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in abuden23 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a3dd35665bdd420f175b6b522ef75b800e178d26b62971b55b20891e5663c0c The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in ishowfeet1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49cfb64273573166bc38b5ef83b722b3a264c8e19870fc65b35eaaa5504a69bf The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in ishowfeet8 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f84766a048383d03dee0415d1cada0c19a19afd27efb5a76217e7333bed084 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in bomboclatwallahi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a7d4f08c0c79c42f9938a1c11d3d6828907fb309e582faf38065bbd04f5149 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in captainindia (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 733cf02dcdf94f8882c708ffcafec943cc986ee2909b6c6800ee9e34c8b8fccb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in gpapp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8adfa222041807cea6aa53e26cca9c0eba0922efbb9afd0d201d90a3ba201165 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @espn-ping/react-dmed-oauth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc0467ac62043cf22dd249a99ff1279646dc599702140998ff5b86c79645364 @espn-ping/[email protected] declares a preinstall lifecycle script node index.js /dev/null 2&1 that automatically executes on npm install...
Malicious code in chai-as-staged (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...
Malicious code in qreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in pull-request-comment-branch (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in oztxrk-mfa (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ovault-evm (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in newsroom-2022 (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in lreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in liportal-web-app (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in lint-prettier (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in latency-tracking-internal (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in lage-npm (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ireactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ibotta-ts (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in icons.generated (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in hreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in google-tag-manager-integration-sample (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in gontawesome (npm)
--- -= Per source details. Do not edit below this line.=-...