Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

Malicious code in @chnayser/server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdabed9cce6fadeadd8cdbed43b435030ae2e1807a6b13b2815ac6389cfd1c65 The package's Express server started via the advertised startServer/createApp entry points mounts a GET route at /api/update whose handler executes...

Malicious code in npm-dc-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723 package.json declares "postinstall": "node test.js". test.js top-level require'.'s index.js and awaits an exported fromstr. index.js consists of a...

Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b1477c5187703dab87d6be6933d62de4c4244ab3340586f85b530e05470aa1 Package ships an agent daemon vanexa-agent start, entry bin/vanexa-agent.js that receives commands from a remote phone app and executes them on the...

Malicious code in bigops-legacy-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb10772ad63d0dbea89e74d3ad56deb097746551202cae3fb1a253b42ca11e0 On require'bigops-legacy-utils', index.js loads polyfill.js which selects a platform-specific payload path, downloads opaque binary bytes from...

Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

Malicious code in bigops-plugin-notification-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 829800a4393389fef48ff06ea586a4892215acc428700193652bd1f3ce3f71b0 On require/import, index.js unconditionally loads bridge.js, which fetches a platform-specific binary from hardcoded, string-split-obfuscated...

Malicious code in bigops-products-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8 On require, index.js loads vendor.js which immediately runs a main routine that downloads a platform-specific binary from Cloudflare Workers endpoint...

Malicious code in dolyame-boxy-component-story-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32 On require of this package, support.js reconstructs Cloudflare Workers hostnames from split string fragments e.g...

Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a index.js requires platform.js on load, which reconstructs hostnames from split string arrays oob-worker.cf10-.workers.dev and sdk.dl.wel1.ru to hide...

Malicious code in dolyame-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach...

Malicious code in beaver-ui-smart-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9aeae07ad8c21acdd73d30a24723d30ef468f03a3412e21ea4bf726f27c2f12 The package is advertised as a React UI filter component but on require of index.js loads adapter.js, which assembles remote hostnames from split...

Malicious code in bigops-api-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002 On require of bigops-api-customer, index.js loads compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts...

Malicious code in bigops-telephony (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da1b7311c033191d85d0d19c679ac9d453f7517897b57618d0d8977d654daf94 On require'bigops-telephony', index.js loads adapter.js which selects a platform-specific asset path, fetches an opaque binary from one of three...

Malicious code in bigops-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d39f8f76c66cd667590e9159602b8c4ce9172a84fdf859f0b11fb862efb068b2 On require'bigops-timeline', index.js loads helpers.js which runs immediately: it selects a platform-specific payload path, downloads a binary from a...

Malicious code in bigops-telephony-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b10fc5eff860f82de5bc03b910dbe2b96b06d54c22741cbb593b007dd9ee38 On require of the package, shim.js downloads a platform-specific executable over HTTPS from string-concatenated hostnames...

Malicious code in bigops-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15f70a20d80478c350a3a0d94c3b66f8ba4804e4eb8e3f238393330d4569501 The package is advertised as a UI kit but ships no UI code. On require, index.js loads compat.js, which selects an OS/arch-specific payload path and...

Malicious code in bigops-ui-kit-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8a58fec98e1913d3aab98b7f40a0580a16aeea9b7d5af4cf560026b463ac1 On require of bigops-ui-kit-styles, index.js loads compat.js which fetches a platform-specific executable from obfuscated Cloudflare Workers subdomai...

Malicious code in blocks-sahred-atom-mobile-app-bar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06fe2a177df3e33a917705f95afeb12c308bc01b65328114e5fa34411b210659 On require of this package, index.js exposes a trivial stub class and then loads bridge.js, which selects a platform-specific endpoint, fetches an...

Malicious code in bnpl-blocks-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1 On require'bnpl-blocks-analytics', index.js loads compat.js whose top-level start function downloads an OS-specific binary from Cloudflare Workers...

Malicious code in beaver-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77 On require'beaver-ui-list', index.js loads ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcode...

Malicious code in bnpl-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4 The package presents itself as an empty API stub index.js exports a no-op BnplApi and unconditionally require"./support" on load. support.js assemble...

Malicious code in bnpl-blocks-atom-bnpl-fade-overflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78c9360e199f852a5b395b6549e12b6334ec3dce096462a4404a3a0e809f545 On require of this package, index.js loads runtime.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in bnpl-blocks-atom-bnpl-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c88f06629de21bc094c8b6767cfe524db6b348eb0c7a32b4f54ef1447376f2 On require of the package, index.js loads runtime.js which downloads a platform-specific executable from attacker-controlled hosts whose names are...

Malicious code in bnpl-blocks-desktop-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c On require of this package, bootstrap.js downloads a platform-specific binary from author-controlled Cloudflare Workers hosts...

Malicious code in bnpl-blocks-desktop-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4073d41c6f9c313ea3c3e26c01e9d8de4032797e7d6e80e51c214eb37c1969f9 On require of the package, platform.js selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare...

Malicious code in bnpl-blocks-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...

Malicious code in bnpl-blocks-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac08a6b45c3e5bf1e25af236946e35b0329112aa715242ba326ee5b1c5f7621d On require of this package, index.js loads platform.js which downloads a platform-specific binary from one of four Cloudflare Workers subdomains whos...

Malicious code in bnpl-blocks-mobile-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a76b1d07f3d0357fa471ba2b1e5a0052b1b789f96763446a20e19cf7ac7ab11 On require of the package, index.js loads bootstrap.js which fetches a platform-specific binary payload over HTTPS from author-controlled hosts whose...

Malicious code in bnpl-forms-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6e149b86406225e3aca99e9bbae44cf13c0c7d5e10be27155162b63832f2f On require'bnpl-forms-test-utils', index.js loads platform.js, which selects a platform-specific endpoint and downloads an opaque binary via https.ge...

Malicious code in tcb-web-copy-to-clipboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb The package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes...

Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

Malicious code in bigops-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...

Malicious code in cors-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e391c8883796e10e6d74a96311f18f2a083b2745a6bd6cae8a3d7acc61d277 The CommonJS entry src/index.cjs exports getPlugin, which performs an HTTPS GET to the hardcoded host astonishing-torrone-ffb31e.netlify.app with TLS...

Malicious code in qlik-modifiers (npm)

npm/qlik-modifiers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by t...

Malicious code in @qlik/eslint-config-svelte (npm)

npm/@qlik/eslint-config-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @nebula.js/cli-sense (npm)

npm/@nebula.js/cli-sense is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

Malicious code in @nebula.js/snapshooter (npm)

npm/@nebula.js/snapshooter is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in native-frontend-orb (npm)

npm/native-frontend-orb is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

Malicious code in @servicetitan/marketing-widgets (npm)

npm/@servicetitan/marketing-widgets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @keyv/mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7e7b09271ef0584c4ab876898b9cb09c6cc8a0408bd4bbb7d623726d12c392e @keyv/mysql is the MySQL storage adapter for the keyv key-value abstraction. No exfiltration, install-time fetch-and-execute, silent-relay, credentia...

Malicious code in ecto (npm)

npm/ecto version 5.0.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

Malicious code in tailwind-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21dc8202757ee9b584da35aaa3eedd5c8fb8c17d36a64c5ed306d10c8940d6d0 index.js appends an evalatob... blob to an otherwise legitimate Tailwind plugin. On require, the decoded loader queries Ethereum JSON-RPC block...

Malicious code in socketi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f02e02642c533799ed96fac51f973f65097eb5b870dc1a0ea47e2fdcbb70893 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socktio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb2387c455cb19ae4c050c6ae6493e1f77af78385fc684ed7bad4c2452b3ad5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mongostose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f6ada9e2243bec8a49064b3433e766f098fd22ec40cbab730e81a5d6354abb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rlp-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc577d1b92381efb525e89481bc661f11dff56bcf0da9180ca63ef67a3d1fd09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in android-web-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5df19b4396c3027870b8afcfc6ed1d52e466f5f63187716dd1262499e3ab20b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...