Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fbd1a1acff8225ac5ce7f3c19a6eb207a79bc1aa842de64d0f697eda839c021 No a static rule matches and no traced installer-harm behaviors were identified in this package version. No lifecycle scripts, credential access...

Malicious code in @gocortexio/npmgremlinbox-arphic-1999 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59cc9e27f4b008a76815433e388b21dadcb6477f6daee80a855b6eaeaf4a79f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-3-0-de (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac07dbbcaab394576264b09782849aa49feace0efe500ab7e1f0967a10649718 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3905018e59676370cb9b0ce2f68f53df18b3ca774fafd9445bd3ce202ab0249 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22de3b316748990f8d632fd0fa7ca312c4f5fd38ddf61986331ae0ad4c14280b No a static rule matches and no traced behavioral findings for this package version. Nothing in the scanned files indicates exfiltration, install-tim...

Malicious code in @gocortexio/npmgremlinbox-artistic-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a54621aca82e78e4ee4adc57b3925274a0c7bf3b2d11d6d5af655c584de7fa45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-agpl-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35ec6a36621ce352ab4510c339ef6a7367f88584b90ebfda17149c79dd947c66 No a static rule matches and no traced installer-harm behaviors were identified in this package version. No lifecycle-script droppers, hardcoded...

Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b9f161ff7fd8e7bf1fd1496277f6839c49d06cb7dd0e6daf772a019fb46b1cd No a static rule matches and no traced malicious behavior were observed in this package version. No credential access, no install/import-time network...

Malicious code in @gocortexio/npmgremlinbox-agpl-3-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d73fb2c55c8b46079aed067487fdfbd542e8308ed577463f7d9ab02a7c06447 No a static rule matches and no traced-code findings indicate installer harm in this version. The package artifacts show no credential access, no...

Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6b2260e2800619ccb9a093618b29bba531fdca6348febc8547be7d925da7b4c No a static rule matches and no traced behavioral findings were produced for this package version. With no evidence of exfiltration, install-time...

Malicious code in telebot-bot-run (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c556b9ded1648a2523210bf518dea35324c749733eabeef3268795351b1b9c On import, telebot-bot-run 0.3 executes two attacker-controlled code paths against the installer's host. First, the top-level module fetches...

Malicious code in @akrai/report (npm)

The @akrai/report package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in markscan-utils (npm)

The markscan-utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...

Malicious code in markscan-core (npm)

The markscan-core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in twilio-internal (npm)

The twilio-internal package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against ...

Malicious code in @markscan/utils (npm)

The @markscan/utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms ...

Malicious code in akrai-report-new (npm)

The akrai-report-new package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

Malicious code in twilio-platform-request (npm)

The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a private...

Malicious code in twilio-deploy (npm)

The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

Malicious code in @akrai/report_new (npm)

The @akrai/reportnew package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

Malicious code in twilio-serverless (npm)

The twilio-serverless package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution agains...

Malicious code in zer0onetencent (npm)

The zer0onetencent package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in iphouse-core (npm)

The iphouse-core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in iphouse-api (npm)

The iphouse-api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in markscan (npm)

The markscan package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that...

Malicious code in akrai-report (npm)

The akrai-report package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in @markscan/reports (npm)

The @markscan/reports package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name form...

Malicious code in aftermath-sui (npm)

The aftermath-sui package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in @iphouse/api (npm)

The @iphouse/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in markscan-api (npm)

The markscan-api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in twilio-platform-async-data-fetch (npm)

The twilio-platform-async-data-fetch package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in markscan-reports (npm)

The markscan-reports package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

Malicious code in @akrai/core (npm)

The @akrai/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in twiliointernal-messaging-toolbox (npm)

The twiliointernal-messaging-toolbox package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in @markscan/api (npm)

The @markscan/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in iphouse (npm)

The iphouse package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that ...

Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

Malicious code in @markscan/core (npm)

The @markscan/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...

Malicious code in @iphouse/core (npm)

The @iphouse/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in zoom-widget-xss-poc-paresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ce7f91ce8bd8ab97268072386ec0890f1edc0336138472d428df845041ac5e Package ships a single browser-side IIFE index.js that manipulates the DOM inserts a banner into root and calls window.widgetSend with a demonstratio...

Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

Malicious code in tinkoff-cloud-apis-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421b85b858849bbf116303f2dc2740180df602dfc162f7ce7fa109e4c39b07ff The package installs a telemetry.pth file into site-packages via a custom install cmdclass; the.pth line imports telemetryinit, causing every...

Malicious code in python-devplatform-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a The package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports telemetryinit, whi...