Malicious code in @ai-agent-node/agent-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8edd22e8454df2a9c10d47ea5c39560f9384598e7fb2a26b26b8f647fd5d2dd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zannstore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 708c069b088fb74064262b95a516de8d4b3f3128bd6705d98ee7e8dc10e942c8 @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to keyword co-occurrence of...

Malicious code in @peptide-unit/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in @peptide-unit/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d2db0b951057e42b31006e9bfd3752cde6db494df5959f44e0243f802d7a32 index.js is a repackaged copy of the legitimate emptyport/unimod peptide-modification lookup library with an obfuscator.io RC4 string-array IIFE...

Malicious code in def-open-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2ab83557d19fac6db95041a0557305c6950f0c181a3998767dfaf011fc02c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in colder-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd07744737c9b6e9ee846d8a15610b53170c6a0fa0937c00251d4b87697bea57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uniapi-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09d612d64d0f85043a8a38f0098a520182eada4e67046bdff3bd6bfd8bf150e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lzd-unified-station-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a7aa719b42fefe9ed02663e521da72cb152008b0db0be8a186524902059c590 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flight-compare-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc2dd463956db0c56774e8da768bd425fbd36a855f2e7d820390bf6c664ee395 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lwp-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f48a24eac1771fb54fd93711a3e41754360ae043cecf84fcff3c3d1bb30d297e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test-skill-zip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90b0b80c790dd0c39844830b06e5388141ddc9a78aa8e79510cb6cd148de1a63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feedback-ai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63f8f94529e580af60ba47ff5cbd40e7bec956dc203a4d944fdfc312a161b75a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in open-worker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f401caae6648708b54670a92075c2ff4fa6fb10f86a7ad73be5fa19eacae2fed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aone-cloud-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac6b6dc6a9ebc0c474150ee0d6545f6c3fa790ada20f247ac997ec504ce6ffc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zer0code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f11a39a2be94308e553081d26ba71cf416858053c84e52674666ba6f4acbf0f Package ships Python files under skills/pentesting.py and tools/security/exploit.py that reference ping commands and shell-spawning primitives...

Malicious code in @finxsecdemo/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be118b4cf0acab2c331cc37f68a19bdbdf2ac8423ef984a1cac5c9f4d21c1e7e The postinstall.js lifecycle script unconditionally issues an HTTPS GET and a DNS resolution against a hardcoded interact.sh/OAST subdomain...

Malicious code in test2221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...

Malicious code in chain-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f9894b15a69a3c8a8cb1c75ee7c5dcb036293212fd2e29ca6676e27369ed79 The package is advertised as a docs/landing site for 'Theta Data API', but its main entry index.js re-exports a single value desKey sourced from...

Malicious code in @bowozzz/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...

Malicious code in @mypwn/hawkeye (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc7070d4697e41f7bd953772681425e677c8ca9539144154b7abde925adef545 The OpenSSF Package Analysis project identified '@mypwn/hawkeye' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

Malicious code in @joyfill/layouts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2f0675d4a2717361ec79b2c5a5cbf0ff0367e8d9cbf991f2f300df6c6b819ec Analysis of @joyfill/[email protected] surfaced no a static rule matches and no traced code paths indicating exfiltration, install-time remot...

Malicious code in @joyfill/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90bed9c7a2d887bec8559ce5eb8d86d3af53b17bfcc685a0469c2f1727979f78 No a static rule matches and no traced behavioral findings were produced for @joyfill/[email protected]. The package artifact does no...

Malicious code in postcss-motion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4534713b2409f1fe5588befb885030edc2eafddf215d1103e70f9024c64cbc35 Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its main index.js is a 164 KB single-file...

Malicious code in aone-kit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4197cd1713e045c09d745c2d3b518df40d695112f76831bd0e921031cac69606 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in local-config-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa2dd509a9d17ced72d7119cf68768f7356d3f67af131e9cbe5bfe981a626ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lib-mtop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1dad2a69d97f4f14b77fdb334f860745feac703828131718a950a54b2d7cece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aone-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb48e61b0c82bff5ed26f7afb8cfca9248ffe0a256db4bd9fd2e47b757e7784d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aone-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8c02fc6bb23600ab64d77ac8f4d615fcf128010f26df033c40ed2dc2476b9ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cloud-config-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a19fd2daa8759d7f8a31f0b54cffd70e5769e2268a447f8ba0b890006edee17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in smart-config-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c23d349475bd923bd4f57440ddd7c07bbfb8b93b746788ecb4b8cc87e1ebae0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...

Malicious code in korvica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODEENV!== 'production', checks for a WSL host mount at...

Malicious code in streak-core-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34 [email protected] presents itself as a 'day-math primitives' library, but index.mjs the package main, executed on any require/import contains an...

Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...

Malicious code in color-convert-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9 The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity hostname, whoami, id, sudo -...

Malicious code in json-schema-inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 023b104d04c30fccd05f5db5842a2d8735c572eb13cfbb5ca7ba763eeb525429 The package advertises itself as a JSON/XML schema validator, but both public entry points validateJson, validateXml in lib/core.js invoke a trigger...

Malicious code in bianira-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...

Malicious code in streak-core-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073175f6a0065dc5cc00d30357053432c69fbc7aab8b92bbe4217ad3d54c5d3a index.mjs executes a top-level async IIFE on import that fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.zip, unzips it into...

Malicious code in @crbrc/xbt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 179d74e089794cb517fcb4030021310137bedcc72f0ef49362b4ce1724cb5ac3 dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets OXAPAYGENERALAPIKEY, OXAPAYMERCHANTAPIKEY,...

Malicious code in kordyn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c379ec39ec7791c9128dc4e1b82199ce29d7540a9a9984036af2ac79de38e1bf [email protected] advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities 'Early release — placeholder...

Malicious code in rollup-runtime-core-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199 The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node repository field points to...

Malicious code in react-puller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3ac07c0f6c79714a7b1f6bfd1272f9f7942cf0473875ca5276a1034c084f06d The package's postinstall hook runs node index.js, which spawns a detached worker that downloads two Windows executables CDPUserPlatform.exe and...

Malicious code in blots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847ba592915f4561a16225808a93d2428bc12305dc3df0bbf5316bf5a5bd7518 package.json defines preinstall and postinstall lifecycle scripts that unconditionally run curl against a hardcoded webhook.site endpoint, transmitti...

Malicious code in array-node-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0dbd4ffa55ee3a0972b3e5e3fef599244049244d9f996a9d8b809a3a3a53e1a The package's main file index.js is a heavily obfuscated obfuscator.io RC4+base64 string-array module whose top-level IIFE runs on require. It loads...

Malicious code in text-line-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...

Malicious code in sigchain-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026 The published dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js contain top-level code that reads an encrypted...

Malicious code in @apexfnd/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8716e3bd410648407039879f991abe8adbde650ab008bac4e41165e7b52c79b1 The npm package @apexfnd/apex ships a postinstall script install.cjs that performs two install-time remote-code-execution actions. On macOS it writes...

Malicious code in node-array-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ce58719e0587902be3a6436f329ce631317fe3a7c322d89f9c679cd6e1a744 index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and literals. On require, the...

Malicious code in streak-daily-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...