Malicious code in @biz44/id99-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malicious code in @biz44/id10-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malicious code in @biz44/id44-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malicious code in cr-bot-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f preinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks t...

Malicious code in ollamaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11eb7019f9ead481b3c5f203703df3b8b63abab2e03502a02ba30360da9948d9 The ollamaa package on PyPI is a one-character typosquat of ollama. Its init.py re-exports everything from the real ollama package so imports appear ...

Malicious code in web3-eth-account (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a The package web3-eth-account typosquats the legitimate eth-account library and copies its metadata ApeWorX/ethereum.org author addresses, README...

Malicious code in etoro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...

Malicious code in mfaby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278e0ee3820cf701ef7ad65dfdab43a0765e5d3423286de99d3301fe39a8455 The package presents itself as a Discord MFA helper, but its cache module contains a warmSession routine that decodes a base64-encoded string CDNBASE...

Malicious code in bq-sdist-probe-vrp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f61d3e118672e10f0dc02115acd8235c3b356d75e7cb59a69e26fec28070c814 setup.py executes at pip install time and performs installer-side credential and host reconnaissance. It queries the GCE/GCP metadata service at...

Malicious code in @umschool/platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcf64895a777467cc94763bfb942be3c04040ca151fc22753ca48ac4aaecd69c @umschool/[email protected] is published to public npm under an internal-looking scope with an implausibly high version number, a resolution shape use...

Malicious code in easypanel-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb103b6863369372ba8c07701264f8b0f6b57e3217e07912c8efbd9371c648f The package's preinstall lifecycle script preinstall.js executes automatically on npm install and collects the installer's hostname, OS username,...

Malicious code in easypanel-hosting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db6a378b33bb2f33088ed90db4ac48e81368e30d5ef38578dca3b4345e9cb06b [email protected] ships a stub index.js module.exports = and an npm preinstall lifecycle script that collects the installer's hostname, usernam...

Malicious code in alloy-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80ee3815d12ec95aedb4bbe0d3de5c516e99163ca1eba52c2a3de7038b9a2ac0 package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, curre...

Malicious code in sonmors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e21634e32b7d24357ad667703da4ddeb42542ed9fc6a3ed28c7257d2e27fca Package sonmors ships a near-copy of the sonner React toast library and spoofs sonner's identity in package.json author Emil Kowalski , homepage...

Malicious code in toru-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...

Malicious code in @aspect-adv-ui/consent-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...

Malicious code in @usemosaik/template-react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...

Malicious code in cb-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b89e0045c311aec83f8b4710dc1709b64bf083541c7ad26d639b89f5c98a7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in base-app-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 385b3732590f10aba4436505fecbd325128919df56f33c060ef3f9f557ead91f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @caliperx2/components (npm)

This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a copy of a private, internal package name. This is a dependency confusion attack. A build that gets the name from public npm installs this package in place of the real one. The...

Malicious code in @liuliang520500/sinataoke_cn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e3ff1d04feca3fcec866427a6d90307e3391fde1e732c8f600a06e86900af5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @liuliang520500/pdd-sdk-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a7499d71351fb91827b6e69cbea52e9a4cd6b3802693d0b4f1b545700e8ad8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liuliang520500/taobao-topclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fce1760178d3d6c27bfbeac47e726c22a17252d491a2988939082c1ead4a4ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 1cattunnel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26b08759ff9575f7cea8ef2e713458337d90c27b83a76df2e43d9b9a0af2e48d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in multicore-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d643b52dafcb56aba0bd945697117be2a15447bcb4b183aabff3fa72824b75fb [email protected] is published under a spoofed author identity Blake Embrey, maintainer of array-flatten and advertises itself as an array utility,...

Malicious code in node-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e7475543fb41397ba49574f9b16340e671160b13bb100bb0db6c4acc2fb154e The package impersonates the legitimate blakeembrey/node-helper library matching author metadata, README, MIT license, and top-of-file helper functio...

Malicious code in jwt-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b56e3f2d5fab071637ba7688de6c2a9c3d1c1846b6ec939b82eb2c8e9ff03956 The package is published as a trivial JWT logging helper but its main module jwt-logger.js is a heavily obfuscated string-array dropper. On require, ...

Malicious code in @domyjs/i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09d7898515b6bfb8ec32fadbbdb3ae21e3550dcdc0980d21d3ee909bf147bf38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in onetime-rnd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f949fd70a8bdf3174426072e1eac3d15e0b00c6ec57e0d3cf0a3ef45ca79ea49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in infinity-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120919aeccbb43dad4717538757f11dcea999b371dc507b10395b6369fd85f46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @yoannchb/cattract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e7abd13f1aa830b5721234537a3e473c8c59527506f8a0daeca72bc17c6e55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jimg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c510cbf9c5077091b3b415ba9ce624c06a1487f6fbe3a74e638d921f8b2ec440 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in google-img-scrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86caa3dfd7fbfa99dfa8042e4792f31346c57427e7eb83cbc468b5a14d4c0e14 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in easypanel-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2744a6f0dfde1930ab560731e54cb8a1e1c8dc61a2072705498ddcaa6dd1a592 The package's preinstall lifecycle script runs automatically on npm install and collects installer identity os.hostname, os.userInfo.username,...

Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

Malicious code in @bx-ui-framework/microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30 package.json declares a runtime dependency microfrontend whose source is a bare HTTPS URL at...

Malicious code in @quantixfinance/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...

Malicious code in google-cloud-internal-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 655e243795a73e8b8b7f7b1c9b4f5769d1d13deba1dc53679fe6153b8405a531 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apple-cktool-internal-api-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faeeff2b18d0a2f9f9a5d8d9543b6d950f49c64f6313b37fc02bc68aa9fd9d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @viertechjs/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a35c7b86ec1a4d9922b7c74dbdab948b868f8cf43a8f5c01053692e6a85803 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tailwindcss-forms-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after...

Malicious code in gas-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e [email protected] impersonates eth-gas-reporter author field set to cgewecke, source tree mirrored, README pivoted to generic 'multi-chain gas...

Malicious code in loading-performance-instrumentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dab9307010475c57195f838ba7d7299fe4a753b92926536aa8376f8d096150 package.json line 11 declares a dependency whose source is a bare URL rather than a registry version range: "loading-performance-instrumentation":...

Malicious code in grafeno-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a52df88a9094028961676cb72f9e43f88fcef959cc4e1db63687785058c2d7d The OpenSSF Package Analysis project identified 'grafeno-actions' @ 999.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in 3layerdipstackvdy7nf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb8345a33d68a541bbd486d2095eda3279011cc8dbc69d8dafcbef98551eedc4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackkpfva6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 630019d614a8c26a144f9502c87e0c4bc16d904adea23a7c202a1d8ba45632b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstacklzflp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10c1545a52cead9f9d1faa1be03bef7ed58b87200a9ff4bfc5b2dc56be7f0263 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack7d0vc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0ec71b1f453c0b7e55711dad1fa36e9df70acb84f3730568936593cb146817f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackcfu35 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 044b8051a8aca89d5eed9f4eb9202524d9c5555e6b4c9dca0fdb8061d5449839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackedqpy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58ba6727af48ece8c4931942d5c3e896e53d11e64fcd2328ca1a9ae65dba822a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...