Malicious code in ssr-catalogue-sfcc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffd2663232d7c5508f63c063736d09a7c1fdfefe9783f5941c9214f687df7fb The package ssr-catalogue-sfcc was found to contain malicious code...

Malicious code in litellm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe LiteLLM was compromised through trivy security scan in a GitHub workflow. Attackers uploaded malicious versions of LiteLLM to PyPI. The...

Malicious code in solana-gateway-contracts-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c99f3ecaa102d6db90dbdb52a98646914489bb992e520c1b527380e7c9574a13 The package solana-gateway-contracts-private was found to contain malicious code...

Malicious code in skyoauth2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c8093f2acd2eeb615402cc142718c4e4ca3d82e4121cd316da58869ba595a2 The package skyoauth2 was found to contain malicious code...

Malicious code in sky-enablement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9712856e1dd6e76d395507a76c21d01a945d4e5490e0d747384212a4a8b7c6df The package sky-enablement was found to contain malicious code...

Malicious code in react-performance-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8467a722c92d3c846a99ea30e0b092dd93fba781c34f93dae9b05582d4475e The package react-performance-suite was found to contain malicious code...

Malicious code in react-fast-utilsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95853c89c144cd1630b70c6d2c5e97e8b3cafd6d8ff628b357c80d6a7f8407b5 The package react-fast-utilsa was found to contain malicious code...

Malicious code in plate-playground-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ac5bae237041bc5b4bbd86a3aa58c9cf5734d4046742565f738e9580f95b3d4 The package plate-playground-template was found to contain malicious code...

Malicious code in phx-core4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f34a66abe0d68aa9e9250d5fea5c5a537be067859159164a917c667923d51d0c The package phx-core4 was found to contain malicious code...

Malicious code in test6789.v3 (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in avvio.sky.userdataservice (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in cortana-md-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 686dc6172d061151a94189d41cd564a6127d00f10af75880962a357301ec135e The package cortana-md-bot was found to contain malicious code. Source: ghsa-malware a712b3a56136d272ebf1a688ff9ea1cc572023730622963df1e6e82389177d28...

Malicious code in krbutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef5a16574ecd987f57925735cdbeb06062b47dc13fda6c1f30a68e9aba9571ad Package is a typosquatting or dependency confusion attempt with a low-harm local-only action, like leaving a flag file. --- Category: PROBABLYPENTEST - Package...

Malicious code in solhint-plugin-hyperlane (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5f1d66ba0771661e6786da7d4953af3fc1ff1e280d1c666abd1e69e481274747 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Malicious code in zod-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d6e0134575d22df9c8acb633e41aeb44e167203581cee75c81264667e9bdee The package zod-js was found to contain malicious code. Source: ghsa-malware df349fd5990c0cb74fcaa574f32fd30796c00bbe619ee60bd0eac1a658c7dd49 Any...

Malicious code in ts-tweetnacl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fc02aaeff144bdf5547d650cfae75b4f8861d765cafa72a8bd01609b8be299b The package ts-tweetnacl was found to contain malicious code. Source: ghsa-malware b8c7022964715c8d5771f3663406b7b80018244bca155ecad7064ba3d2b2ce5e A...

Malicious code in elf-stats-snowy-northstar-860 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 060b69056cb70a9b63f02519787bc1ab10049d2dd86aef53a7e777a2176ec8ac The package elf-stats-snowy-northstar-860 was found to contain malicious code...

Malicious code in codemirror-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788b98a42ba1658c92e6e86494ddd747ab154a01be456dfe9656760bd264fe46 The package codemirror-5 was found to contain malicious code. Source: ghsa-malware 0803dd9e41e867827659b46d2934d1a9700667e0f731dce60093ab5f9457c07f A...

Malicious code in index-gamma-authorize-deploy-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 855a93e5306676df25469d50536f602165b1a8e5b59b3116fe63ffd6dba16314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in byte-decompress-cold-deploy-wind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ef141eff83134eb1dccf37d5ed667b1a2bb43d54e22c1432a3be0635611317e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in muny-boph-batu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ec65661fd12498f37b3c8db6aff9f26f02f9d06a738c3d63bb82529001268ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @sellerly-kit/theme-sellerly (npm)

The package @sellerly-kit/theme-sellerly was found to contain malicious code...

Malicious code in neo4j-apoc-procedures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ae32122ca71a7a075fce5993dbcdceca009308664157c1655b4b3897e205f3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in anyswappoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11b4883135435c180fd5e1ec5f7f3d0ce3da30f86c240121ed36c3f2c09f1441 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grammyjs-utils (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45f0349da339aac302d4c3bf992403e9bd539caa80f29576e448ccf3fb4af016 Any computer that has this package installed or...

Malicious code in fca-nvt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f96380ff5d08b4a65d9a20156bb99f8945ff4b34487354b250d78b583013b8d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in py-proofrandreplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a2aef03260ce84ff7cbb288e6bc7151b60750570a378bd9effe6c30d1c979dfc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in n8n-nodes-moonlet-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f49ee5bcbcb7e8f1028de4021134fdbbc895e737700cf82a834fb26d3b23dd05 postinstall.js fetches an opaque binary from https://mkicom.com/.well-known/pki-validation/ctdn8, writes it to /tmp/.nc, chmods it 0755, and launches...

Malicious code in some-tool-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e053568381d2b1cf3b7e62e3152651c843cfc3e32f056574d7a64dae4531b2e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

Malicious code in @uh-platform/webcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...

Malicious code in requests-auroras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afa39517de816c01400eef99ef6ebce1357910c217c5e0ff55e4a252ea15a4c5 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

Malicious code in @traktis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...

Malicious code in strapi-plugin-osag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34d9349a970008e54774fc533af589248d578e1d34f6f82a9a6630beeabd2203 The package presents itself as a Strapi plugin but ships no plugin code — only a postinstall.js script that runs automatically on npm install. The...

Malicious code in discord-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...

Malicious code in tetomood (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92 package.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory $pwd and machine...

Malicious code in @biz44/id99-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malicious code in @biz44/id10-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malicious code in web3-eth-account (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a The package web3-eth-account typosquats the legitimate eth-account library and copies its metadata ApeWorX/ethereum.org author addresses, README...

Malicious code in base-app-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 385b3732590f10aba4436505fecbd325128919df56f33c060ef3f9f557ead91f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liuliang520500/sinataoke_cn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e3ff1d04feca3fcec866427a6d90307e3391fde1e732c8f600a06e86900af5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in jimg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c510cbf9c5077091b3b415ba9ce624c06a1487f6fbe3a74e638d921f8b2ec440 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in google-cloud-internal-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 655e243795a73e8b8b7f7b1c9b4f5769d1d13deba1dc53679fe6153b8405a531 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apple-cktool-internal-api-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faeeff2b18d0a2f9f9a5d8d9543b6d950f49c64f6313b37fc02bc68aa9fd9d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gas-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e [email protected] impersonates eth-gas-reporter author field set to cgewecke, source tree mirrored, README pivoted to generic 'multi-chain gas...

Malicious code in 3layerdipstackvdy7nf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb8345a33d68a541bbd486d2095eda3279011cc8dbc69d8dafcbef98551eedc4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackkpfva6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 630019d614a8c26a144f9502c87e0c4bc16d904adea23a7c202a1d8ba45632b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack7d0vc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0ec71b1f453c0b7e55711dad1fa36e9df70acb84f3730568936593cb146817f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackedqpy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58ba6727af48ece8c4931942d5c3e896e53d11e64fcd2328ca1a9ae65dba822a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...