233095 matches found
Malicious code in miranda-nconf-package-puppeteer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4861844fae84d7b05a5030f56b0acc16628a4c8ba3f5d874c50d0f49d20539dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in ocha-wajit43-breki (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b4a26815086fa83a214c65f086386c1e1cae5a7cac8466d009eda7b70ccb10a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in ade-toge58-miaww (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f09c1be360e6ab51f0b45e0c97005cbef9dda05c87b9b3fc60d7a78c32bafe0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in wati-klanting13-breki (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36e9f6e3b00ad08548753112a3e8a4532290cddb7e8f018fa02044ee2e0c0a27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in @chatgptclaude_club/claude-code (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a4754ec4fdda490eb8df83dba70a4eca2d697b1db00133e748d26661ebc17a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in diet_earthsmoke (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 83df3701a52a02b6ef7891d5d4151dbb02e7c649eb524a250a2992c625f82529 The OpenSSF Package Analysis project identified 'dietearthsmoke' @ 0.3.1 rubygems as malicious. It is considered malicious because: - The packag...
Malicious code in tectonophysics-dione-thermosphere-meissa (npm)
The package tectonophysics-dione-thermosphere-meissa was found to contain malicious code...
Malicious code in cli-plugin-graphiql (npm)
The package cli-plugin-graphiql was found to contain malicious code...
Malicious code in acme-dns-01-freedns (npm)
The package acme-dns-01-freedns was found to contain malicious code...
Malicious code in test-mlw2-defat-boats (npm)
The package test-mlw2-defat-boats was found to contain malicious code...
Malicious code in darkenergy-unuk-barnard-package (npm)
The package darkenergy-unuk-barnard-package was found to contain malicious code...
Malicious code in bonnet-ltd (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90d8066c671e4c70fdd26ffc5ac6d901d34541c2cff4aaaf2c118c977078aec4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ai_challenge (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cac3284458d7620929c88bceb52c6a1050042e2974e32bf76827af876c55b4be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @ethena/shared-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aef2408e95a098dd74ce27cc6b45910bd5662840209b1b083e75ccfadd5f51c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @douinfe/semi-illustrations (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @douinfe/semi-animation-react (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in celexkeygen (npm)
The package contains code to download and execute an infostealer payload. --- -= Per source details. Do not edit below this line.=-...
Malicious code in python-dateutil-malicious (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e746200736f98b51154e3cfbafa826ee92b8badb2005dac0e8fb4765cc3cbc57 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Malicious code in down_load_ebook_summer_at_the_chateau_by_jennifer_bohnet_wo77n (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in list-issue-predecessor-dependencies-block (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd4d4e3aa51ec1a7ebc0a0d4f728698503432546f139f67998849f8fff9b614 npm package [email protected] auto-executes index.js from three lifecycle hooks preinstall, install, postinstall on np...
Malicious code in mongostose (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f6ada9e2243bec8a49064b3433e766f098fd22ec40cbab730e81a5d6354abb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in simple-probe-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...
Malicious code in xerohub-discord-voice-v3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a2e867e455a79a59e233b1536348eca9ba4b72c217997c4ceea032e7a5ad2fe XerohubVoice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the package author. startVoiceJoiner...
Malicious code in lib-streak-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...
Malicious code in fluid-type-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...
Malicious code in tailwind-motionkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84dfdf101e36c7ca60ca1a1e72d59a7893a5abee9bf359852cdeabdb0af2cd2 Review of [email protected] surfaced no evidence of exfiltration, install-time remote code execution, silent relay, credential distribution,...
Malicious code in kalipto-runtime (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...
Malicious code in edu-npm-helper-alpha (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48359fa2dbbcd9c21e22de20140343078cd697b1bdfa5f3c59ce5ee77b4865b0 No suspicious code patterns, lifecycle hooks, network destinations, or credential-access behaviors were identified in this package version. Nothing i...
Malicious code in txs-runner-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf4e668ad1a65cf7be8d260ba2c6ee46a31be7553bad3219775b61a5d226dfc Package [email protected] could not be fully characterized: automated tracing engaged with the package's files but its output was withheld by the...
Malicious code in @sqlite-tag/schema-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c0c9a31c77b90dcf433595d03bef3c4752075f134be6b4568dccf2751bc63d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in blessclient (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82efbe82f1f4cdc513a33b4deeb7a811318155aaf4de1d4319dc54f8730f409b The package name matches Lyft's internal python-blessclient and is published on the public index as a dependency-confusion tripwire. setup.py overrid...
Malicious code in preferenceslifecycle-paypal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e33d1db03ba9b9f1d9dc9f4c81a574e5baa69549e6c1897230540fe15d2749a3 The package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir, and dns.getServers an...
Malicious code in fundraiserservicepp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6356b654b692d4c1222f3dc31dcfad683a6e193a41484d3c617c7c8d52db2313 On npm install, the package's preinstall lifecycle executes index.js which collects os.hostname, os.platform, and os.arch and POSTs them as JSON over...
Malicious code in trongridy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a437be8ac21a8c375aeb02c4ab825bce027392f95aa356491950536454d2bf58 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
Malicious code in discordnv (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...
Malicious code in app-data-lts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f9d67601ec8b46265e1f23f5e48ff5beb050626f4bc156b291cb1b8f8c36d35 package.json declares postinstall node test.js and main: index.js, but index.js is absent from the tarball. test.js executes require'.', which throws...
Malicious code in govapkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...
Malicious code in caldryn (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c9be7dd8b0d1fe026c48f500d432db06ebfb7bbb0721e3b1426cd29940fd1e No a static rule matches and no traced behavioral findings were produced for this package version. There is no observed evidence of install-time or...
Malicious code in veskr (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05d4b49dfdad9ef3eb4605e61998fab98f41bb282c48020b91492ea25f0c0d97 No a static rule matches and no traced code behavior indicating exfiltration, install-time remote code execution, silent relay, credential...
Malicious code in react-tabulix-extended (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...
Malicious code in faust-cont (npm)
The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...
Malicious code in ecto-cargo-wk1tm59a (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee496f01ecebc77637213e597ba523c8cccda7efcd65e7ad2e700d804553dd29 Package [email protected] exhibits several contextual red flags worth human review: a randomized-suffix name pattern -wk1tm59a typical of...
Malicious code in claude-code-timer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04950731ec6589eebae22166fb042e4253719f71bfd3fc2b58f28d26ede9e43c [email protected] was scanned with no findings of concern. No install-time lifecycle scripts, no outbound network calls to attacker-controlled...
Malicious code in bytecraft (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b4433b369e2ff82bc33b11110ddfa63c15a2d685bf3484fb37092ae4bd077f No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity, lifecycle scripts fetching...
Malicious code in analysis-chart (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @examplecorptest/hearsay-design-system-test (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @gocortexio/npmgremlinbox-cal-1-0-combined-work-exception (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76e5b6e244c7645a990797de600bbe5b61534485f8037ec0b8b865a50c10b523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in akrai-report-new (npm)
The akrai-report-new package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...
Malicious code in @iphouse/api (npm)
The @iphouse/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...
Malicious code in markscan (npm)
The markscan package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that...