Malicious code in @chnayser/server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdabed9cce6fadeadd8cdbed43b435030ae2e1807a6b13b2815ac6389cfd1c65 The package's Express server started via the advertised startServer/createApp entry points mounts a GET route at /api/update whose handler executes...

Malicious code in clawtrl-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c The package's cli.js imports childprocess, https, and os, reads process.env and system information via os.tmpdir and related os APIs, spawns a bash...

Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

Malicious code in dippy-invertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8dbed78de451c63784d37e7ae925bc4bf1288b7c4cf6e0e6fb0e7f9ff4cd451 On require'dippy-invertor', index.js unconditionally loads ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers...

Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a index.js requires platform.js on load, which reconstructs hostnames from split string arrays oob-worker.cf10-.workers.dev and sdk.dl.wel1.ru to hide...

Malicious code in dolyame-boxy-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

Malicious code in bigops-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d8d967bce96a9d30c6af4599e7658d63327067655539f14f2bfd1cd8a663350 The package advertises itself as a stylelint 'quality gate' but on require its main entry loads bootstrap.js, which downloads a platform-specific...

Malicious code in bigops-tcrm-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f4cc9ef61d16a5c70a1adc9c2ab3acb9e51d650967f02621410285d99efd4a1 The package's main index.js requires./setup on load. setup.js selects a platform-specific payload path, downloads a native binary over HTTPS from...

Malicious code in bigops-tinkoff-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cb54c5f503b1cad2b4ae932f592d8870df743b1c1b6b029616343b65f6ae09 On require of the package, index.js loads runtime.js which fetches a platform-specific binary from Cloudflare Workers hosts...

Malicious code in bigops-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15f70a20d80478c350a3a0d94c3b66f8ba4804e4eb8e3f238393330d4569501 The package is advertised as a UI kit but ships no UI code. On require, index.js loads compat.js, which selects an OS/arch-specific payload path and...

Malicious code in bigops-watchdog-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7bfa2b0d9464df6662fddb4e969b42ef35465f2c70ba39943ac3fb0265aa781 On require of the package, index.js loads vendor.js which selects a platform-specific URL, downloads an opaque binary from one of several Cloudflare...

Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

Malicious code in blocks-sahred-atom-mobile-app-bar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06fe2a177df3e33a917705f95afeb12c308bc01b65328114e5fa34411b210659 On require of this package, index.js exposes a trivial stub class and then loads bridge.js, which selects a platform-specific endpoint, fetches an...

Malicious code in bnpl-blocks-atom-bnpl-action-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f63c6572613805a02fc6c829d61dbd9a3aaa9b300147c9fe2f1fc74821cef8 On require of the package, index.js loads loader.js which selects a platform-specific payload path, fetches bytes from one of three runtime-assembled...

Malicious code in bnpl-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4 The package presents itself as an empty API stub index.js exports a no-op BnplApi and unconditionally require"./support" on load. support.js assemble...

Malicious code in bnpl-blocks-atom-bnpl-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2cdda88c39101955d7333e81f68b9cefe2dbfab23862351194168e2c61e5e9 index.js unconditionally requires./support at package load. support.js reconstructs a list of Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd082c1e27c32145bec8b47cf81fa12cde384fd542629dd340c514d71728f8 On require, index.js loads ext.js which assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

Malicious code in bnpl-blocks-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac730391d7dd3e3b320792e22983d3d225a08701364594a2db02d8c19f1bf868 Requiring this package executes platform.js, which detects the host OS/arch, fetches an opaque binary from one of four author-controlled Cloudflare...

Malicious code in bnpl-blocks-independent-bnpl-items (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b068b10c6608e86812242f222c2936a85aae90776b6c71298731c16f8d7ae31 On require of this package, index.js loads runtime.js which selects a platform-specific asset, fetches an opaque binary from one of three obfuscated...

Malicious code in bnpl-blocks-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a On require of this package, index.js loads adapter.js which selects a platform-specific asset path, reassembles destination hostnames from split...

Malicious code in statist-browser-typed-client-risktech.uwfrontantifraud.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26 On require/import, compat.js reached from index.js downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains...

Malicious code in mcp-audit-sync-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897822fdfb08c83d7d949c16e497d6897b9b679cc2f05a0409b1ec369a1f10fc [email protected] declares scripts.preinstall = 'node index.js'. On Windows, index.js spawns a hidden PowerShell process that fetches a...

Malicious code in @qlik/eslint-config-svelte (npm)

npm/@qlik/eslint-config-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/dte-pdf-editor (npm)

npm/@servicetitan/dte-pdf-editor is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/link-item (npm)

npm/@servicetitan/link-item is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @ornikar/eslint-config-formatjs (npm)

npm/@ornikar/eslint-config-formatjs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

Malicious code in mongostose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f6ada9e2243bec8a49064b3433e766f098fd22ec40cbab730e81a5d6354abb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers-io-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d93060f754bea6c9c2c5722e253ef9599335702d72a39effe29b2b7668937dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethe.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab166dc6e7cba65e133a48f30493d785512b96592dd9e86b960621ec2125cfcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-bubble (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 956b35c3b022736d505e63ff195d09af3bfe315d35774c9544de2e3569affab8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pumpdot-fun/pump-swap-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76046e38de05fa61bcbae6bc4edf1a1e6b704f7c99e4ca8e57a16bbe06380dcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dwa-tridion-webapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37c90162581ec29b8ddc34bb27f128d0fd51c537f9a31eff6389d046c520235b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ncc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47e6426d64d44f277630e33c26db683f2d8cc1c043374a88ed3a484c84f7a242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thedata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...

Malicious code in ai-perf-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83 On import, the package's top-level init.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 usi...

Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

Malicious code in colder-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd07744737c9b6e9ee846d8a15610b53170c6a0fa0937c00251d4b87697bea57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flight-compare-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc2dd463956db0c56774e8da768bd425fbd36a855f2e7d820390bf6c664ee395 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

Malicious code in @vaultflow/create-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48 On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 a gist owned by...

Malicious code in @heartlandone-private/fontawesome-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc8f9f53c05ecc2642ce82c3841e046025662c206f002b4c6da11ff0cbc763d The package's postinstall lifecycle hook runs node index.js, which issues an HTTPS GET to a hardcoded Burp Collaborator subdomain at...

Malicious code in stargateproxyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f37695676321e5bdbf3c1ff13f97619eb46b57d7796f66c3b1448633626858 [email protected] declares a preinstall script that runs node index.js, which collects installer host identifiers os.hostname, os.platform,...

Malicious code in random-ua-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 543206058a0b8e85c8227a0bfdd4752fc61779b24968a0bd5d50ae6b3040387b During import, the code starts a keylogger and exfiltrates data from cryptowallets. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in whs4_eud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5 [email protected] declares a postinstall lifecycle script node index.js that fires unconditionally on npm install. On execution, index.js POSTs...

Malicious code in identityscimapiserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e866098aa6115f837577cc3b24eae409fb1fb67167757f2f0c5517dfa9d8d209 The package's preinstall hook runs index.js, which collects hostname, platform, architecture, home directory, and DNS server list via the Node os...

Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058782981a80d3fc90af74a840a00cefa0c58b9861c481d0444b7f4f3e6a014b On npm install, the package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir,...