Malicious code in briantreehttp (npm)

briantreehttp is a typosquatting package impersonating braintreehttp, the HTTP client library published by Braintree/PayPal. The package bundles the legitimate library source to appear functional while hiding a credential-theft payload in index1.js, which is executed at install time via the...

Malicious code in web3-py-checksum (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4b2052172f5c854b2e91f6bdc9336a97469cd161372621a1880d9cd1e3ad426a The code silently exfiltrates the private key of a crypto account. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in erslove (npm)

erslove is a typosquatting package impersonating resolve, the module resolution library implementing require.resolve semantics. The package bundles the legitimate resolve source and test fixtures to appear functional while hiding a credential-theft payload in index1.js, executed at install time v...

Malicious code in camelotlabs-core (npm)

Five packages camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry at version 99.0.0 by the actor madman0619 as a dependency confusion attack targeting the internal npm packages of Camelot Labs. The inflated...

Malicious code in @tableau__catalog-messages/database_lower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4155e0aa6cc429c2ea66b3b131055983379b13cab66b74fa3c1758e83a48ec54 The package @tableaucatalog-messages/databaselower was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in base-x-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2486f9bad36944300cb58e1a73a370afef7be10040daf814861d1b1a6287cdb8 The package base-x-64 was found to contain malicious code. Source: ghsa-malware d09ca9d36cb3821dc878f97db3b7e8ddef6f5f8e390373492186d10b668718f3 Any...

Malicious code in corsair-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c21d47c9d59d6abd121ee300ec8e6981d0fc22576fb01ca69c06633e5e46626 The package corsair-module was found to contain malicious code...

Malicious code in whatnot-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7124b844cb92c573d57e94d1060a58445a82d03984c430e1632807fda9d227 The package whatnot-web was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ui-core_mal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c66ea54316ebd799590186156adab4ff03ad3108487b4c5c48192924efcd60a The package ui-coremal was found to contain malicious code...

Malicious code in test-bugbounty-package-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52ee2c6095d9dfd6bdd4945e804a736035b9e29d4265e6a0e455aff026911be7 The package test-bugbounty-package-6 was found to contain malicious code...

Malicious code in ssf-desktop-api-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49396220b88ccf03b280b2ccbf09f84a3c871d1877ca7db06fd0e3fb78221305 The package ssf-desktop-api-electron was found to contain malicious code...

Malicious code in snort-security-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27bb4a30a492a84e3b126941b2ca78dd48b2c494c55ee4e4861527e7c2bf1524 The package snort-security-tool was found to contain malicious code...

Malicious code in skyoauth2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c8093f2acd2eeb615402cc142718c4e4ca3d82e4121cd316da58869ba595a2 The package skyoauth2 was found to contain malicious code...

Malicious code in safeness-sb-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9766c02e9c5a79f96104b5089c06ae16b472ff7734284462bd3bfe0fe3c4a687 The package safeness-sb-new was found to contain malicious code...

Malicious code in react-performance-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8467a722c92d3c846a99ea30e0b092dd93fba781c34f93dae9b05582d4475e The package react-performance-suite was found to contain malicious code...

Malicious code in pru-lib-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23f37bedfc6e1d85a81c4656a0af7b09fd927fb8d1562702d8766104ba806d95 The package pru-lib-ng was found to contain malicious code...

Malicious code in player-common-controls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aef58425992286c8ee1bba6bb26ba161a52a852bb7ed8a6087e737b91d02e8b The package player-common-controls was found to contain malicious code...

Malicious code in phx-core5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b50389bf1ccd774bf7ef41ddc301049375776e994f84731a4baf15104bdbd7a The package phx-core5 was found to contain malicious code...

Malicious code in 3rugfbe8rivferiuv (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in react-svg-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63577e9faa19bf76dac1f171ee006ed6801a0726d5782ae1246bde01b508a7ad The package react-svg-handler was found to contain malicious code. Source: ghsa-malware...

Malicious code in @msecscc/gaia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c005bdb108aca2e4bc9842086fa98dd73b442764e4e7814fd6e7a9fa7010dd The package @msecscc/gaia was found to contain malicious code. Source: ghsa-malware 5186ac1e518b181d1e03469aa042d8dddefbe3345b3c85d5b795ed329e5c3a73...

Malicious code in tablescene (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 75f24eaea6c977e93d35c431f9bedc66b7757fd5c5635425c28801dad3b50de9 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

Malicious code in zalando-consent-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfebb7ed5c3e35afeff037425cd019134eb927484b619019f7d11b13d6fe59c5 The package zalando-consent-api was found to contain malicious code. Source: ghsa-malware...

Malicious code in solhint-plugin-hyperlane (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5f1d66ba0771661e6786da7d4953af3fc1ff1e280d1c666abd1e69e481274747 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in grepleaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbb12eb31b13d48c3bceaf932a48991331324e560fdf0dba37561862844fa2e8 The package grepleaks was found to contain malicious code. Source: ghsa-malware 3017ce71ea8163be051e049bafc4e07b09bcc4cf3b05675c0e5c300c105705ce Any...

Malicious code in @kyriba/mf-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa1b2dd3479a677d975d11f8fe29e2cb24cbcc3a90c05081fa1632822c7c2f5a The package @kyriba/mf-kit was found to contain malicious code. Source: ghsa-malware 5316d385b586e69d62f54165ad5c9a973bf0bdfc3ef7023a0f7f53c784bb7131...

Malicious code in @lokeswari-satyanarayanan/rn-zustand-expo-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73fe3bd99e2f11ab8bb09a9086c4dca8af56372031492ed11d90f1e32a0e8f53 The package @lokeswari-satyanarayanan/rn-zustand-expo-template was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/slate-serializer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb7716bab0bde17a29c041cd61a934d39d4717019743671e8d6164fd166c0bdc The package @voiceflow/slate-serializer was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/ensjs-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f73575f4b186fbdf20e0a27b2bd9e1fae8839ea9f17e4648c96e6d4bf4f96da The package @ensdomains/ensjs-react was found to contain malicious code. Source: ghsa-malware...

Malicious code in norma-tool-stratigraphy-stop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc0d54c69ea8d5d3fb2526b4c3613bc17ab6bd6c2ce8287d64c44fa51ff62cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in link-theta-float-class-balance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0217fbc8ce82958f98e07fb84597a7fb29c01d324de938f4aca90bcef15b747a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-ks-fua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c71b313793417f9a31321f5c7476f52ac0189fc1395fdf0c8e70a876cdccc59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ilal-poke37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6543636f229f4e8f325816f2d3ca64aa191d08dac12d32e662454bb940f7c614 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @sellerly-kit/theme-sellerly (npm)

The package @sellerly-kit/theme-sellerly was found to contain malicious code...

Malicious code in appdynamics-libagent-napi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3ccb8490c24108245e9e5e4893518e881e48f0dafa4b0ad152ab458de4e7b1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cobo-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f1c1c4efd134e130c04178382ff3ea318301fb18b5eb6eed696c49cf64e9ad6 It appears to be a forgotten pentest checking typosquatting against cobo-custody package, but may also have malicious purposes. During installation, if a machi...

Malicious code in @superbet-group/web.lib.global-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46cc2b86741ff5c827214db058e91d1ac9641020a946a1d1f358d5e575488529 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in autotrain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1deb572c61112a157412e8781f95a21939512f7662411eb81e582eba0f1db7df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jest-utils-lwc-internals (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c648c3492e79706f76e42a3e0ee3bf0d79e36fc2996157477622d919419e8f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...

Malicious code in grafeno-billing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72306b800994fea3aa6c6d12e137657ffe70ec9ac6c44abfe3ceaa547ef8e5c6 [email protected] is a stub package whose only substantive code is a preinstall lifecycle hook. On npm install, preinstall.js enumerates...

Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

Malicious code in vitest-chalk-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running...

Malicious code in confluence-create-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011485304eea045bddd134da5fdabfcf9d96acd0f2c78e1800a4c32674a5788c package.json declares a dependency whose key equals the package's own name confluence-create-content and whose value is a bare HTTPS URL,...

Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

Malicious code in data-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa1f0fee2d6635331e603f520ba2954b11ac9e85bbd5b66f27c18be5940c3041 package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL...

Malicious code in one-intuit-help-system-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c22e9eaa97b1ee548e6ca6ac6257ea72fed0ee92d5b54255781e62b8ae19783 package.json declares a dependency whose key equals the package's own name one-intuit-help-system-utils and whose value is a bare HTTPS URL...

Malicious code in mintel-taskbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL...

Malicious code in search-reservation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76642f0709b362fd800a9842b53bdb8f26413b9acf26562c4a5737c7bae3e856 package.json declares a dependency whose key equals the package's own name search-reservation and whose value is the bare URL...

Malicious code in 3layerdipstackpcv17m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341115d5cb8bd44ffcf82bc4d8d35f995473df6f24abccb910c9c16fb70cea36 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...