Malicious code in zrgvqf269 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zrgvp100 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zrgvhe14c (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zrgvbi2729 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zpx52489fm (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zlam_httpsno (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zjpage5 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in zjiamd3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in xla21778568189 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wnumghplcqou (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wgsfmore63 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wcalamp (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandscal3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandhr8 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandfosurl (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wanddbbehg03 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandczvof7git (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandczvof1hg (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in v20zzgbqvirfx (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in uxhttpslamb1 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in tryd2zz (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in swcaltesta (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in swaim5a (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sprox-c160-4svn (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sm8280qgal (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in slwsvn7762 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rxlws (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oakmi17200 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaiex1182709 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in mt8320mzji (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hwc4v (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hgrangex2 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hackbzr1778554791 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in exfiltestwand5 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in eiljtjmugmrf (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in paperclip-adapter-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d49d1a6c5381f58370cbfedc2321bd44796eb4ea79541d967a661760d9759801 [email protected] executes a credential-theft and C2 backdoor automatically on import. The package's main re-exports...

Malicious code in lint-nuler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f9e0e240b15ecbe934992f121b12fa84d736e4432e20346c7860941517acaf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @flex-ng/error-component (npm)

The @flex-ng/error-component package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the...

Malicious code in gen-ai-opt-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3653831a01d3068b12688a9f6ae11926a1b1edde27f8f37a6c48f3f0dba99231 On npm install, postinstall.js executes automatically and collects installer host identifiers os.hostname, os.userInfo.username plus public IP/geo da...

Malicious code in vps-maintenance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da5dcc405a10775ace9fab68ee0a5ddf9bcad770d29e20f999df6d41072e46b1 On import of dist/server/index.js, a top-level block spawns a detached shell that 1 appends a hardcoded attacker ssh-ed25519 public key comment eni@l...

Malicious code in epic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8936b0c0d22097170c5eb02c9b183611934e59e7a3c97f94e3a269e13f0d4d5 The package.json preinstall script auto-executes on npm install and performs installer-side reconnaissance and credential theft. It collects...

Malicious code in polymarket-trading-developer-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...

Malicious code in vega-lite-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c98ee24f91eaab2bc8360306a75519ae167dcbc3c7bd38cc395fbaa9590f4cd Package name impersonates the popular vega-lite library but ships no vega functionality — only a preinstall exfiltration stub. package.json declares...

Malicious code in vitest-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e0165cbb3d6ed37a96889c4b016463706346e1c09413635c31ea1ceedde8774 The package's postinstall script node lib/utils/index.js spawns a detached, stdio-suppressed Node child process that runs...

Malicious code in @mcconnect/mcc-common-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be912fccd62d30a685cdb31baa7155b91a283043d74447d1d7099ffbaa73b1dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in clx-cookieparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b7ab13cd76393ea58b540ccf13b4ab4660edb4fac210d86a67e51b45fa1d0c Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name 'clx-cookieparser' and declares a repository field...

Malicious code in loadutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31f1f1f6292d782062f6fff1f7422d9f1dc0eb1572e4372d6c0d574ccea3ab3a Package loadutils is a typosquat of the widely-used webpack helper loader-utils. The shipped README documents the loader-utils API urlToRequest,...

Malicious code in ollama-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52323ef2a3908b7db1565ae149128d053363ab2612c7bc3a938c3f2d63c285cf scripts/postinstall.js executes automatically on npm install and performs a bulk harvest of installer-side identity and configuration data: OS hostna...

Malicious code in dtxto1ols (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 926fc822a2a507fafa6d2e1bb02a9b2bada7d89d3042bd3f0cac0ba2fd7c1991 package.json declares a postinstall script that runs automatically on npm install. The script performs filesystem reconnaissance find / -type f...

Malicious code in openblox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdd874a78973f84b5373fc03a48472c338ca82ef0a258b7614f81a8359da1201 setup.py invokes GetGitCommitHash unconditionally at module top level, so it runs on pip install openblox and any setuptools invocation. On Windows t...