Malicious code in dolyame-boxy-component-story-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32 On require of this package, support.js reconstructs Cloudflare Workers hostnames from split string fragments e.g...

Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

Malicious code in dolyame-boxy-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4340fab762980b85544094ef1795fd82968bb58c7fe0f17a00f50b2df89b29d5 On require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and...

Malicious code in dolyame-boxy-mobile-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d25f027b45e1dd0483fdacb92c8af5b25302f2785de7a7a5c259b8d535597d80 On require of the package, bootstrap.js fetches an opaque binary over HTTPS from a rotating list of Cloudflare Workers subdomains with a DNS-TXT...

Malicious code in dolyame-boxy-mobile-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870 On require of this package, index.js unconditionally loads ext.js, which reconstructs C2 hostnames at runtime by joining split string fragments...

Malicious code in dolyame-ui-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b0f03a063fb3a6b8c7605612b587eddfefa6181b85b14654ee93f267dd790e1 On require of the package, index.js loads compat.js, which at module load time downloads a platform-specific binary from hostnames assembled at runti...

Malicious code in dolyame-ui-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242 [email protected] is published as a React component library but ships no UI code. On require, index.js loads shim.js, which downloads a...

Malicious code in beaver-ui-side-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d On require/import of the package, index.js unconditionally loads helpers.js which fetches a platform-specific binary from attacker-controlled...

Malicious code in bi-core-bi-core-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1 On require of the package, index.js triggers compat.js which selects a per-platform binary path, downloads bytes from runtime-assembled...

Malicious code in bigops-api-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002 On require of bigops-api-customer, index.js loads compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts...

Malicious code in bigops-alerts-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1ece35b981e6725d807e3bfe7da2bc7e2129bb49fa6f656866ace6f67079284 On require of bigops-alerts-widget, vendor.js selects a payload path based on process.platform and process.arch, downloads an opaque binary from one ...

Malicious code in bigops-timeline-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a6a5b474ef344ddb8aa478f73099e3644817aa8a87199eaa3c46f03d27baa13 On require of bigops-timeline-ui, index.js loads./adapter.js which fetches a platform-specific binary from Cloudflare Workers hosts whose names are...

Malicious code in beaver-ui-object-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6 On require'beaver-ui-object-card', index.js loads ext.js which selects a platform-specific asset path and downloads an unsigned native binary from...

Malicious code in bigops-tslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6335298379affbc02ca5288e29777324f4d13ddec51b21ce999bb6eeda3996f The package advertises itself as a lint tool but its index.js unconditionally requires./ext, which on load selects a platform-specific payload path,...

Malicious code in bnpl-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4 The package presents itself as an empty API stub index.js exports a no-op BnplApi and unconditionally require"./support" on load. support.js assemble...

Malicious code in bnpl-blocks-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd082c1e27c32145bec8b47cf81fa12cde384fd542629dd340c514d71728f8 On require, index.js loads ext.js which assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...

Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

Malicious code in bnpl-blocks-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8ebc784cdc9c083f42cf6323e773eb7bf43b1b927c936c609bb8d93a90bb4cb On any require/import of this package, index.js loads ext.js which downloads a platform-specific binary over HTTPS from string-split-obfuscated...

Malicious code in bnpl-blocks-desktop-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e0ae14a5603433798af1dda72f0e9c1ae60505afa9205177c558c208d362b5e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

Malicious code in bnpl-blocks-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62fa2b8c94722055f1345a068fc74b842d0fe8120702208c73f2defd93744194 On require of this package, index.js loads runtime.js which downloads a platform-specific binary over HTTPS from obfuscated hosts...

Malicious code in bnpl-blocks-independent-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6696fe044c6853369150682d33490cf557f26081c7143ed87f7a3624dda53d On require of bnpl-blocks-independent-bnpl-documents, index.js loads support.js, which selects a platform-specific asset, fetches a native binary fro...

Malicious code in bnpl-blocks-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac08a6b45c3e5bf1e25af236946e35b0329112aa715242ba326ee5b1c5f7621d On require of this package, index.js loads platform.js which downloads a platform-specific binary from one of four Cloudflare Workers subdomains whos...

Malicious code in bnpl-blocks-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a0a2e3786f50dc07b4546de5ae22f3a65ad50e95897b8ca4d0fa6460b32d63 On require of bnpl-blocks-scroll, index.js loads helpers.js, which selects a platform-specific payload path and fetches an opaque native executable v...

Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc On require, index.js loads loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints...

Malicious code in mcp-audit-sync-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897822fdfb08c83d7d949c16e497d6897b9b679cc2f05a0409b1ec369a1f10fc [email protected] declares scripts.preinstall = 'node index.js'. On Windows, index.js spawns a hidden PowerShell process that fetches a...

Malicious code in bnpl-blocks-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e70389e1435e74337e9c402d824a2e90eeb0b2e9f82fc670035973a18382c558 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from runtime-assembled .workers.dev hosts...

Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

Malicious code in geocode-quick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419 The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment...

Malicious code in alipclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode... with a...

Malicious code in streak-metricsazb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4ea1b382140e833e01605ec5278b7a9a877aaaddd96ea9057efef2560b66b2 On import of the package's main entry, a top-level async IIFE in index.mjs labelled 'ENGINE INITIALIZATION & CALIBRATION' copies the shipped file...

Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

Malicious code in @or-sdk/files-sync-node (npm)

npm/@or-sdk/files-sync-node is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/form (npm)

npm/@servicetitan/form is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in ecto (npm)

npm/ecto version 5.0.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

Malicious code in tailwind-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21dc8202757ee9b584da35aaa3eedd5c8fb8c17d36a64c5ed306d10c8940d6d0 index.js appends an evalatob... blob to an otherwise legitimate Tailwind plugin. On require, the decoded loader queries Ethereum JSON-RPC block...

Malicious code in walmart-genai-trace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e84b4bbb5660ea5c7f803c4e5d0b12dfe41c9bb147fd2228c72bdda2224291a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...

Malicious code in soccketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fc9cac2969243ba864ef1645d5d99ed62e8e4906bc58cd32cee3fad42c9c528 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rlp-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc577d1b92381efb525e89481bc661f11dff56bcf0da9180ca63ef67a3d1fd09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethe.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab166dc6e7cba65e133a48f30493d785512b96592dd9e86b960621ec2125cfcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in android-web-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5df19b4396c3027870b8afcfc6ed1d52e466f5f63187716dd1262499e3ab20b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @solana-utils/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abda158dfd80788df38b2221a5a9715eb7d6bebadb9569cfc51774985f39b0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @patternfly-4/quickstarts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5c84bc12cb0c8215b572e242d8268710430f7bb4c16d7ce4ac25a072cd39e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @patternfly-4/react-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5f54e5643951668f9122f9909e456f67938b47d7ecb0cddf1fde02666a66ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ethers-sdk/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38a8c103dc06261576987809af8a1deb696dfdabd93bf4116f42ee199ee77cc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ethers-sdk/ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e6d5bcfe574a6eecbff6a32c084a7abd43660939adafa83c7097a96d1ca791f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

Malicious code in consumerweb-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa886e4b335d3fc76fa6bc8e50c2e428ac164165830705c0ab2847857c2b3aa7 The package's preinstall lifecycle script runs automatically on npm install. It collects the installer's OS username os.userInfo.username, hostname...

Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f5e3f7f8e637ac814a5040b2e61c8608327f73b1c44352e694848a8c35e181 On import, server.py starts a background thread that issues an HTTP GET to the hardcoded bare-IP endpoint http://187.127.73.142:8777 carrying a...