Malicious code in blocks-sahred-atom-mobile-app-bar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06fe2a177df3e33a917705f95afeb12c308bc01b65328114e5fa34411b210659 On require of this package, index.js exposes a trivial stub class and then loads bridge.js, which selects a platform-specific endpoint, fetches an...

Malicious code in bnpl-blocks-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1 On require'bnpl-blocks-analytics', index.js loads compat.js whose top-level start function downloads an OS-specific binary from Cloudflare Workers...

Malicious code in beaver-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77 On require'beaver-ui-list', index.js loads ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcode...

Malicious code in bnpl-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4 The package presents itself as an empty API stub index.js exports a no-op BnplApi and unconditionally require"./support" on load. support.js assemble...

Malicious code in bnpl-blocks-atom-bnpl-fade-overflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78c9360e199f852a5b395b6549e12b6334ec3dce096462a4404a3a0e809f545 On require of this package, index.js loads runtime.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in bnpl-blocks-atom-bnpl-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c88f06629de21bc094c8b6767cfe524db6b348eb0c7a32b4f54ef1447376f2 On require of the package, index.js loads runtime.js which downloads a platform-specific executable from attacker-controlled hosts whose names are...

Malicious code in bnpl-blocks-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac730391d7dd3e3b320792e22983d3d225a08701364594a2db02d8c19f1bf868 Requiring this package executes platform.js, which detects the host OS/arch, fetches an opaque binary from one of four author-controlled Cloudflare...

Malicious code in bnpl-blocks-desktop-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4073d41c6f9c313ea3c3e26c01e9d8de4032797e7d6e80e51c214eb37c1969f9 On require of the package, platform.js selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare...

Malicious code in bnpl-blocks-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...

Malicious code in bnpl-blocks-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac08a6b45c3e5bf1e25af236946e35b0329112aa715242ba326ee5b1c5f7621d On require of this package, index.js loads platform.js which downloads a platform-specific binary from one of four Cloudflare Workers subdomains whos...

Malicious code in bnpl-blocks-mobile-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a76b1d07f3d0357fa471ba2b1e5a0052b1b789f96763446a20e19cf7ac7ab11 On require of the package, index.js loads bootstrap.js which fetches a platform-specific binary payload over HTTPS from author-controlled hosts whose...

Malicious code in bnpl-forms-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6e149b86406225e3aca99e9bbae44cf13c0c7d5e10be27155162b63832f2f On require'bnpl-forms-test-utils', index.js loads platform.js, which selects a platform-specific endpoint and downloads an opaque binary via https.ge...

Malicious code in gekko-trading-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efc19985c853a3f4fdc8bdb1f08b432456b8f55ce701567edbf593fb3e6211c The package's postinstall hook runs setup.js, which unconditionally downloads core.exe from the hardcoded Cloudflare Workers subdomain...

Malicious code in tcb-web-copy-to-clipboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb The package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes...

Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

Malicious code in bigops-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...

Malicious code in cors-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e391c8883796e10e6d74a96311f18f2a083b2745a6bd6cae8a3d7acc61d277 The CommonJS entry src/index.cjs exports getPlugin, which performs an HTTPS GET to the hardcoded host astonishing-torrone-ffb31e.netlify.app with TLS...

Malicious code in qlik-modifiers (npm)

npm/qlik-modifiers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by t...

Malicious code in @qlik/eslint-config-svelte (npm)

npm/@qlik/eslint-config-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @nebula.js/cli-sense (npm)

npm/@nebula.js/cli-sense is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

Malicious code in @nebula.js/snapshooter (npm)

npm/@nebula.js/snapshooter is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in native-frontend-orb (npm)

npm/native-frontend-orb is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

Malicious code in @servicetitan/marketing-widgets (npm)

npm/@servicetitan/marketing-widgets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @keyv/mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7e7b09271ef0584c4ab876898b9cb09c6cc8a0408bd4bbb7d623726d12c392e @keyv/mysql is the MySQL storage adapter for the keyv key-value abstraction. No exfiltration, install-time fetch-and-execute, silent-relay, credentia...

Malicious code in ecto (npm)

npm/ecto version 5.0.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

Malicious code in tailwind-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21dc8202757ee9b584da35aaa3eedd5c8fb8c17d36a64c5ed306d10c8940d6d0 index.js appends an evalatob... blob to an otherwise legitimate Tailwind plugin. On require, the decoded loader queries Ethereum JSON-RPC block...

Malicious code in socketi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f02e02642c533799ed96fac51f973f65097eb5b870dc1a0ea47e2fdcbb70893 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socktio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb2387c455cb19ae4c050c6ae6493e1f77af78385fc684ed7bad4c2452b3ad5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mongostose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f6ada9e2243bec8a49064b3433e766f098fd22ec40cbab730e81a5d6354abb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rlp-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc577d1b92381efb525e89481bc661f11dff56bcf0da9180ca63ef67a3d1fd09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in android-web-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5df19b4396c3027870b8afcfc6ed1d52e466f5f63187716dd1262499e3ab20b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @solana-utils/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abda158dfd80788df38b2221a5a9715eb7d6bebadb9569cfc51774985f39b0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pumpdot-fun/pump-swap-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76046e38de05fa61bcbae6bc4edf1a1e6b704f7c99e4ca8e57a16bbe06380dcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ncc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47e6426d64d44f277630e33c26db683f2d8cc1c043374a88ed3a484c84f7a242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ethers-sdk/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38a8c103dc06261576987809af8a1deb696dfdabd93bf4116f42ee199ee77cc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

Malicious code in create-backend-scaffold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0201b01c3bd9dbea597956acb10299aa22cd7976dcb7863348892f46512b47f1 playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer aliases require/module to...

Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

Malicious code in colder-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd07744737c9b6e9ee846d8a15610b53170c6a0fa0937c00251d4b87697bea57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flight-compare-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc2dd463956db0c56774e8da768bd425fbd36a855f2e7d820390bf6c664ee395 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test2221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...

Malicious code in @apexfnd/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8716e3bd410648407039879f991abe8adbde650ab008bac4e41165e7b52c79b1 The npm package @apexfnd/apex ships a postinstall script install.cjs that performs two install-time remote-code-execution actions. On macOS it writes...

Malicious code in date-sanitize-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b6764b7711cfa03cf6b3a2f70e24b3256a61ac9319d45200ada236fe7c3ed2 The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install and performs installer-side...

Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47761909a1686ad1db2239f5055c8526e38ac88c07060c886157d157d15b4315 package.json declares a preinstall script that runs node index.js on npm install. index.js collects host identifiers os.hostname, os.platform, os.arc...

Malicious code in kalipto-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...

Malicious code in @thone33/react-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 656fe3d401e0d4fed0ad443f49971c4e173132d173cc7eb443a1ccca731bc5cf Package @thone33/[email protected] was scanned and no a static rule matches or behavioral findings were produced. No evidence of credential access,...

Malicious code in txs-runner-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf4e668ad1a65cf7be8d260ba2c6ee46a31be7553bad3219775b61a5d226dfc Package [email protected] could not be fully characterized: automated tracing engaged with the package's files but its output was withheld by the...

Malicious code in txs-sdk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 591592a5e386a92265d0197e095f692b23b00aabfd23f20bd4d29f156cd7c21a Package [email protected] could not be fully characterized: automated code tracing engaged with the package contents but the resulting output was...

Malicious code in @vinnxcode/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92b886dd14e44e2d8c35f297283b6bf7eb3cc0e947d786130c5fd8976d7ebdc1 Analysis of this package version surfaced no a static rule matches and no traced install-time or import-time behaviors indicating credential theft,...