Malicious code in hydration-ui-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d848dd11c0e0692f1f47c8fcb3cb0506316e96ab32f8b63a8913ad67e9570318 Package main dist/index.mjs locates dist/internal/mathcalc.mjs — a raw x8664 ELF binary shipped under an.mjs extension and described in the README as...

Malicious code in @bx-ui-framework/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b8886bf47df30ba72e888647d651e72defd41c1172a4307c438562183d7a32 package.json declares a dependency whose key equals the package's own name @bx-ui-framework/common and whose value is a bare HTTPS URL...

Malicious code in tsshare (PyPI)

The PyPI package tsshare is malicious. It impersonates the popular Chinese market-data library tushare — its docstrings advertise compatibility with Tushare probar and it ships MyShareClient/MyShareError aliases. tsshare/client.py conceals its default API endpoint by base64-decoding it at runtime...

Malicious code in vscode-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7221ac368a033274adc0a36ebde3b997cdb7ea0fe82b4f6cea1b75e8f37bca9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in html_vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1617e904ee9a3f603febf67c0fac2f7a3c80032d623015264de2daf983e64e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...

Malicious code in @quantixfinance/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32aaaa83ee6908df0267edb30ac90d4c87ef22bb803f2aca0c97b15348af95d4 The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions. The real behavior is in...

Malicious code in @quantixfinance/supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f7218e15bdaaead1d170d28c2b67949c808b52985e36ec2f993573af1312f The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped substrings key, secre...

Malicious code in priority-slot-queue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28d9070a4736fe0ceeb43d3f01cad7456582c802e6bb0f84ab6b4e1050947316 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-time-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a259c39e0c762f33b09b298c1fe8ae606adb43422478d06979461b816edf0985 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-lru-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6842cca5e4f00ee191865c33d73bef23be7df2e06f8157394532bb26d9749a42 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in guci-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8eec13cc0ba860ec3d0fced651c1d65f4122d358a8afc9a8b806d9d712d96af2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in google-cloud-internal-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 655e243795a73e8b8b7f7b1c9b4f5769d1d13deba1dc53679fe6153b8405a531 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in google-cloud-mono-repo-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6a8a52a13a2bca203b074422db3b908a9b961e1b849a86734a6a2a38f9504a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frank-apple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2074ea7bc8e4cebf5e583f23cb534632931139d702252dfc554b75bfb5866072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in google-cloud-internal-build-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1728b138f6952e0dc34092093671684665336dc895872005137581f1aa13fe93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @yane88/ripgrep-win (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c09d2a7b42fb9d603ab4b8d0a2afedab22f28e00295c870c4f140ef7dbec78ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @yane88/idea-2026.2-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3124a1c9acaf74c188df39d5f082e62a04b41a7440d16c5689f67e6202f0fa6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in claude-channel-telegram (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7715d12c1677dbf8b8ba4747cced0f41211f3be783d159685b9108d312d586f1 [email protected] is a dependency-confusion lure with no functional code. package.json wires both preinstall and postinstall lifecycle...

Malicious code in hyperliquid-composer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fb2b7d17a47aa4fcd585374f33063197f52d6ba8619e4105ae5a1d30331bb62 bin/cli.js also declared as the package main collects the installer's username via whoami / os.userInfo, plus os.hostname and platform, and POSTs the...

Malicious code in test__123q2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386 On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an...

Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

Malicious code in mfa.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436 lib/cache.js reconstructs a base64-fragmented URL decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR.603-vhKDRdgKl3RalNTVUZYGPsJy2Y and, t...

Malicious code in test__123q1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6 The package declares a postinstall hook node dist/script.js while its declared main entry dist/index.js is an inert 105-byte stub, so the entire...

Malicious code in @baipiaodajun/podman_env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a3511ea2cf04c3094ed5559b5c23d0ebdf37d2100b904a3a37deaa0375ddab8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @baipiaodajun/mcbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9b824aabfb54c78238352f2f5c5a9842353be165da9e42d9f1604a6fdb923b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @baipiaodajun/mcbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 263956cd317cc9d1f0b3a68862e1f3c75ed8fa2652adcf49956e792184559c8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @baipiaodajun/reverseproxy-fm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccf42e2bbdc37821aaae826c6225239d6a8ceeb3b1e89744b79f99c8de98bb28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @baipiaodajun/npmsshx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e607fe03408d07ef1d219557cdf4a173b4c59fb061fe4aaaeedfcb03d1d5a8f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pig-ui-first (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 101f4ed775c904f1711511e291a76113103ac463d5b9002b77eed3970065be0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in js-array-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...

Malicious code in eip712-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...

Malicious code in 3layerdipstackpvsk6r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34830364afafa686e2e3f603e1dcebc4e837e0cbc4080216d6587d1b8f64850 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack71tlcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81c76775c03270d6161e9fa4d0be119873dc051cbe3ac0c0635687203fbdb8fa The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackrvc9k (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be081352be9a48c3e345b835cab9c021999436ea5ebb3651bb7a4a97b62b8ed5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack97rmzr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13188e2cc25d797008ddcbc32e1f27d89e1c3de6f64ff67b9c5e021f2ac1e7c3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstacksh21o (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc5543572867567826e9ddf2b780db506e9735272e29709e97609637c48914d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackepcy6k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbff2752b9d3ba3e63797345d056ec6a89bac32e4f0a7251581c6cee4eb0648 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack7lknl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6611ec62b6f8623df5dd819bb66d682635bcc9c5f0d3fa55a9d2b3ee05be07b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack0y4arx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b0ee85099f27ca35f55b12120ad7980852aab16079399ddf94f3dec87c8deea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack1lb2r (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1792d68f1a0682ffcc4badabadd779b61886345521ea96f41487930ba1635754 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackpsq4vf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88e2901e885945196c6056ba3e4fb253b0972d43153dd4c20116bebad00d986 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack8b4dts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0604815d0e1d83e0e957507b9156680d37378b39587baeedf3d953823601979 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackm7yxnp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09336ebef4c50f052006252dae03f683c0359975cab4ca749cfc49410b86d098 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackl7gab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebbd6f3b295c4ebff364fdf968fe3c08e1b418d11e6bd7271999159641bda037 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackvb5y6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a9a6cee13556e1977ca40657781de0b5d72f5e2491d8767ab659ab1e6c424da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackp5nvj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 558312cfc333f2aaafe0bfb533132147f64249a3a3476bcac89384b317944adb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack0ighvf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3c67605bb4b5d3282bcf9506116696f4ab657e9543918314b0726e2fd153d1b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackzhnxi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 651eed48f507679546a5f64754114510ce28cd2e6ff5b61759b8d2c0e33e4e4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack1eognp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cff722257765397d39ae1e9d1b93bc298de19ee2f1ace23154f41e3166f9227a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...