Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and...

Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...

Malicious code in sme-rko-finance-front-operations-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js...

Malicious code in sme-rko-finance-front-operations-penalty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887 On require of the package, runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...

Malicious code in sme-rko-finance-front-operations-feed-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc index.js unconditionally requires./runtime on package load. runtime.js selects a platform-specific endpoint, downloads a binary over HTTPS from one o...

Malicious code in svelte-cache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...

Malicious code in @depup/memfs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 267188642a5aa8db495698be0d44bd4fed45e0e247572d44da6b76e3d1b72a5e This package is an automated 'DepUp' republish of memfs whose lib/index.js and lib/index.d.ts have been stripped of the upstream source and rewritten...

Malicious code in @depup/astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7c6330072ae71974da0dd2e0e72a33334a35b78ec5679536d95b9f205032225 This package is published under the @depup scope but sets author to 'withastro' and repository to github.com/withastro/astro, framing itself as a...

Malicious code in @depup/aws-sdk__credential-provider-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d @depup/aws-sdkcredential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author...

Malicious code in dolyame-ui-inputsearchtagged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9880fbbce0555f24a1b8910b6271c9b74bd210c1e2aad74bee6ef21338c2eff3 On require of the package, init.js selects a platform-specific payload, downloads opaque bytes over HTTPS from a rotating set of anonymous Cloudflare...

Malicious code in dolyame-ui-inputcount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four...

Malicious code in dolyame-ui-datatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains...

Malicious code in dolyame-ui-inputtag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8 On require of the package's main entry, index.js loads init.js which downloads a platform-specific executable from hardcoded oob-worker..workers.dev...

Malicious code in dolyame-ui-tabslayout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd On require of the package, index.js loads lib/telemetry.js and polyfill.js, both of which contain dropper logic that selects an OS-specific path,...

Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

Malicious code in @prototypevip/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b0068015e90b8e47dd9b67c66ed1d0b0cc4c1ebccd985f08efd31837d27ce8 @prototypevip/baileys is a fork of the Baileys WhatsApp library. lib/Store/prototype-store.js registers a listener on the 'messages.upsert' event tha...

Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...

Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

Malicious code in stretchshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60 package.json declares a postinstall hook that runs node demo/demo.js base, which shell-invokes git clone...

Malicious code in @love-moon/conductor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ea5d4f1af0a0b67e6f74bfb45867ce0b33136083138e3c23a56df03d8b5c902 The conductor daemon command bin/conductor-daemon.js - src/daemon.js opens a WebSocket to https://conductor.conductor-ai.top or a user-configured...

Malicious code in @diezyyasha/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd6b728a9ecc8547f7199d74cfc1070334a586f5fd7fed6e87e332b70945c733 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @innocarpe/deepseek-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecff1188eb08eef1faffb2e898fe393c3311abdf5e96f041435a5ca12163dc67 The npm package's postinstall script scripts/postinstall.js requires childprocess and issues POST requests carrying environment and host identifier...

Malicious code in @0l00000l/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb367562977f8319b3d37aab67a64f2298ae3a9b41d5980a7c66d22c3d135923 The package presents itself as a generic authentication library and exposes register/login/logout/verifyEmail/forgotPassword/resetPassword/verifyToke...

Malicious code in 9remote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0 9remote is a remote-shell tool: its CLI launches an HTTP/WebSocket server and provisions a Cloudflare Quick Tunnel that exposes the host to the publi...

Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

Malicious code in @zahlen/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...

Malicious code in @afasinatickets/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2eaa8543223afa988f2c6782fb481354f16cafdb28fac01b9221e4c97a2f2f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @chnayser/server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdabed9cce6fadeadd8cdbed43b435030ae2e1807a6b13b2815ac6389cfd1c65 The package's Express server started via the advertised startServer/createApp entry points mounts a GET route at /api/update whose handler executes...

Malicious code in clawtrl-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c The package's cli.js imports childprocess, https, and os, reads process.env and system information via os.tmpdir and related os APIs, spawns a bash...

Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

Malicious code in chatcc-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a69e686f3f793120840abd296a10a4b1c8d734797607e7dce82a82e90cf7cf0 chatcc-agent runs a daemon that connects to Tencent Cloud IM as a WebSocket client and treats inbound peer messages of type 'terminalcommand',...

Malicious code in bigops-legacy-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb10772ad63d0dbea89e74d3ad56deb097746551202cae3fb1a253b42ca11e0 On require'bigops-legacy-utils', index.js loads polyfill.js which selects a platform-specific payload path, downloads opaque binary bytes from...

Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

Malicious code in bigops-plugin-notification-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 829800a4393389fef48ff06ea586a4892215acc428700193652bd1f3ce3f71b0 On require/import, index.js unconditionally loads bridge.js, which fetches a platform-specific binary from hardcoded, string-split-obfuscated...

Malicious code in bigops-storio-ngrx-component-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8f5027d945d8a05fe554b838ba2036e29a99c4296ad532b8d47a1bbaa22650e The package name resembles @ngrx/component-store. The main entry index.js requires./helpers, which on module load assembles attacker-controlled...

Malicious code in devplatform-spa-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru,...

Malicious code in dippy-invertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8dbed78de451c63784d37e7ae925bc4bf1288b7c4cf6e0e6fb0e7f9ff4cd451 On require'dippy-invertor', index.js unconditionally loads ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers...

Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as...

Malicious code in dolyame-boxy-desktop-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241 On require, index.js loads./platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers...

Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...

Malicious code in dolyame-boxy-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95d52abe2ced4314ede2df4d3475d73fb87f52298434cdbf6469bf057613346f index.js unconditionally requires./init at module load time. init.js selects a platform-specific path, fetches an opaque native binary over HTTPS fro...

Malicious code in dolyame-boxy-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310 On require of the package, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary fro...

Malicious code in beaver-ui-popover-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a6f956dc3e60442172279367aeb7cbfb758a853f844c53b3ff22a972f0bac5 On require'beaver-ui-popover-card', support.js downloads a platform-specific binary from Cloudflare Workers endpoints whose hostnames are assembled a...

Malicious code in devplatform-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from...

Malicious code in beaver-ui-pagination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8f562892f21caf2a12230c52507a333a5ada223f98964094838657072adcb On require'beaver-ui-pagination', index.js loads init.js which selects a platform key and downloads a binary from string-split-obfuscated hosts...