Malicious code in @greenlake/context-pane (npm)

@greenlake/context-pane is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.0 has a postinstall script that runs node beacon.cjs on npm instal...

Malicious code in @greenlake/common-context (npm)

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 99.0.1, 3.0.0 has a postinstall script that runs node beacon.cjs on npm...

Malicious code in @greenlake/auth (npm)

@greenlake/auth is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0 has a postinstall script that runs node beacon.cjs on npm install, and index.js...

Malicious code in sitecard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9f44333ae4aa62e60d153dfbdc535cd08f778e917a1052ecaf43722d8a7165d sitecard exposes a workspace directory over SSH via public relays srv.us, upterm, cloudflare/cloudflared, devtunnel, ws-relay as its advertised...

Malicious code in jobwharf (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbfb11d059a4f43447527c793da1228d2bfec1aba386532a3b2eecd00b3a9256 Analysis of jobwharf 0.1.0 for pypi surfaced no indicators of supply-chain attack behavior. No install-time or import-time network activity, no...

Malicious code in slatejob (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f05d3bc2833096e10d1893d82730f31f2288d826f76e94ce63fb5dfb356083b1 The package slatejob 0.1.0 was examined and no indicators of installer-side harm were identified. No lifecycle network fetches, no outbound...

Malicious code in reedworker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e3e7e4b377a02ec129d648a7b048736d59389c30267009fc378ed3c1e48dbc Analysis of reedworker 0.1.0 on PyPI surfaced no indicators of supply-chain attack behavior. No install-time or import-time network activity, no...

Malicious code in loadferry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddac804a8e64115b31c6c4a2e45417f7c283c358cf80f9a76391118861512d85 Analysis of loadferry 0.1.0 on PyPI surfaced no indicators of installer harm. No install-time or import-time network activity, credential or...

Malicious code in runpier (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecab8a842f7dfacaf3a6294e3dd3c3a1d9c170e1ad119d52f65a94ef431fd262 Package runpier version 0.1.0 on PyPI was scanned across 10 files. No install-time network activity, no subprocess or exec invocations tied to remote...

Malicious code in sedgehaul (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cde2a585dd043f57af2c96aa193590190a335a411f0b2fa2f52d0ee2ec17bb9 Package sedgehaul version 0.1.0 was scanned across 11 files. No install-time or import-time network activity, credential or filesystem access to...

Malicious code in taskquay (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62e5ff7b7f42b9a62e4e143ad3bec7df066ea92c529f6e7b908c531b13abf237 The package taskquay 0.1.0 was examined and no credential access, outbound network activity, install-time code execution, dropper, silent-relay, or...

Malicious code in marshrunner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b31e9ef561aa7074fd3ce1090d59e6e314fddeb7fc6892cbdc72257c84eb7556 Package marshrunner version 0.1.0 on PyPI was scanned with no a static rule matches and no traced behaviors indicating installer-side harm. No...

Malicious code in workslip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed989756ad2ee3d30bbbc314bc4b4338bf246f6e3643c9fe57df33d0f2a9649 Analysis of workslip 0.1.0 on PyPI surfaced no a static rule matches and no traced behaviors indicative of supply-chain attack patterns. No...

Malicious code in brookworker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fa8f50bb0987926fc5691a191a0622aec1da809cdce6246c63de73cd679f7c2 The package brookworker 0.1.0 was examined and no credential theft, install-time or import-time code execution, outbound network beacons, dropper...

Malicious code in cobbleload (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20ee522ae4bca552485c294db9f0b73cb261f97f80379f2b7bde2a2f82d10ae3 Package cobbleload version 0.1.0 on PyPI was scanned across 10 files with no a static rule matches and no traced behavioral findings. No install-time...

Malicious code in brambletask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed3c7b9b467652f58bd7ff55383900d1e7fbe73c1acbce4c79e12040b96ce9f Analysis of brambletask 0.1.0 on PyPI surfaced no indicators of supply-chain attack behavior. No install-time or import-time network activity, no...

Malicious code in ferretqueue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c588ca6b9a165d16dfd359719e48c63cbcddf5c6e141076cc9a42165a0ae689b The package ferretqueue 0.1.0 contains no observed install-time network activity, no lifecycle code that fetches or executes remote content, no reads...

Malicious code in otterload (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a18fefd3ce281d250aec34b05b6f11f1100968f8bda69e9961b795031fd5bb1b No a static rule matches and no traced-code findings were produced for otterload 0.1.0 on PyPI. The package exhibits no lifecycle-time network...

Malicious code in badgertask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec1f79725a3b93471456baaf9c5b4ea9b889270fb5526070a136c1c9e06b08c Analysis of badgertask 0.1.0 produced no findings indicating installer-side harm. No install-time or import-time network activity, credential or...

Malicious code in larchworker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 87e174c9dc2485263894e4d6c3d1560589659afbfbe9397ca1e1b53fb21d96b3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in thornqueue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea756029aedec54cd447267056236a9c4a6752d1a9973198ebf71c300fcd9112 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in thistlerun (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c35afe278e655040c47dcca9e63b4ab75c1530880041568e544700daa20e887 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in juniperrun (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 013530dce5f4cdf34262deb2b4b105f7336b0248085fc26b815aa4e932f0cd72 Package juniperrun 0.1.0 on PyPI shows no indicators of installer-side harm in the files scanned. No install-time network activity, no lifecycle hook...

Malicious code in flintqueue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02d1a0fd24e2ff483690bd10527de9cc0eef12b8eca08487707a66725117d58b Review of flintqueue 0.1.0 on PyPI did not surface install-time or import-time behavior that targets the installer. No lifecycle hook network I/O, no...

Malicious code in kestreljob (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4a86144582538adae41c5d2f14f22daae1f65ecf9b93cdeb0d82889681af9222 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in skillward (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ad90106c904f14f7b4987775b3e5701d66fc6ca669f4de658dd442bfb9f61 skillward ships a set of lint/scan rules under dist/rules/ that detect suspicious patterns in other code. SW003-encoded-payload.js contains detection...

Malicious code in onsokets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86e89c263593521f9795193907958f4c642d34253fe9a65526dea1c681808760 onsokets/run.py walks the Android primary storage path /storage/emulated/0/, collects files ending in.json,.py,.pyrubi, and.txt, zips them by...

Malicious code in qowa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5 src/qowa/init.py contains calls to socket.gethostname at lines 30, 52, and 247 together with hardcoded Telegram Bot API endpoints...

Malicious code in @grabcad/preferences-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c846a3e9766d663572fb4d716588823020e219af5c1fb75793661c5c87627ba5 The package presents itself as a 'Compatibility shim' under the @grabcad scope and exports a Proxy that returns no-op functions for any property...

Malicious code in @grabcad/user-license (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a248afa43b99998214621142f85910afc980f1a664c8f6a227b523984f88ea49 The package ships a beacon.cjs module that is wired to run both automatically on install via package.json postinstall: node beacon.cjs and on every...

Malicious code in @grabcad/grabcad-shop-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b255034a9e973919c82be7b2f75db934cc8a385c6cb388c6d632769b6ed0889 The package publishes under the @grabcad scope but provides no real functionality: index.js exports a Proxy stub that no-ops every property access, a...

Malicious code in @grabcad/company-server-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77669bd2c3c9138e7d3ab0612febc058dfd8235eb812a40ffb5bf3f27d19bf47 Package self-describes as a Compatibility shim. for the @grabcad scope and ships no real functionality: index.js exports a Proxy whose property acces...

Malicious code in @cecm-web-sdk/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01486f39bf686dc3adf20501374bdaa430fab9a7125a995cd63352e3d50c3bad The package has no functional code: its declared main index.js exports a Proxy whose property access returns no-op functions, and the package describ...

Malicious code in @blueskydataplatform/shared-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14dc8f9eae8cbd57b164126f279baf9f73a7bc68d6a75674dd6bdd8b4f8027f9 The package ships a beacon.cjs module that collects installer host identifiers hostname, install path, cwd, Node.js version via require'os',...

Malicious code in @ecg-internal/js-react-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 533583f613bf03556a1660b5bd8eaf4d5899c96dc79f4c42ae6b883aea8fde0e The package is published under an internal-looking scope @ecg-internal and ships a stub main module that returns a Proxy of no-op functions for every...

Malicious code in @ecg-internal/aurora-js-formatters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02325fb617beffd55194047faca7300b33934cd471de94bab66a24954200cba0 The package uses an internal-looking scope @ecg-internal and an implausibly high version 99.0.1 consistent with dependency-confusion targeting. On...

Malicious code in @ecg-internal/media-util-js-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c716438d9014063b4616588b1522ba2de2f3cf4fd961212840ed6a324cced3da The package publishes to the public npm registry under the scoped name @ecg-internal/media-util-js-lib, which resembles an internal namespace. It shi...

Malicious code in @ecg-internal/favourites-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0f37fd70766d2ddda31ffe3b985eba596fd927fdd589a9ceff04d4a695e3bb1 The package publishes under the internal-looking scope @ecg-internal/ and ships a postinstall script beacon.cjs plus a top-level require side effect ...

Malicious code in @ecg-internal/adobe-dmp-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a24a1672f5d2075c0159dee85aaad5dcb27d0cdc7eb6e007bfdbb742b82149f Package uses the @ecg-internal/ scope resembling an internal namespace and ships a minimal stub whose only effect is to beacon host identifiers to a...

Malicious code in @ecg-internal/reviews-dialog-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d077157e19fb33158004d020ab55ba68751851a9dbab6a010064a83b8436c4 The npm package @ecg-internal/[email protected] is a dependency-confusion payload targeting an internal @ecg-internal/ scope. package.json...

Malicious code in @tekmidian/pai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26877c40609e311219c5193d5c1e2c50b5edf63913c0e4d7ad2be298e11f631 The package ships a bundled Node CLI under dist/ composed of multiple minified.mjs chunks cli, cli2, hooks/worker-, routing, project-setup,...

Malicious code in react-native-bright-sdk (npm)

react-native-bright-sdk 9000.0.0 is a dependency-confusion package that squats the name of a React Native SDK that is distributed privately as a tarball outside the npm registry. Its preinstall script runs node canary.js, which collects the machine's hostname and a timestamp, base64-encodes them...

Malicious code in @factiii/runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4c4794df8d9ce74d46f674a9e583b9a296e9fea534e654a5b5dfd46c1a342a @factiii/runner is a remote-development bridge that pairs the installer's machine with Factiii's mobile/web clients over WebRTC through...

Malicious code in journey-teste-shellhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in @seggy116/next-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdaf2231c55ef54e12dae1b21d66b26c516db292f26c753dcc49a62745eca4ea The package ships a bundled UI asset at dist/ui/app.js in which the token 'ping' appears multiple times on a single minified line. No code path reads...

Malicious code in @pkgship/frps-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f2c1a511013dd65df6260ab26fef946005adb17532ab20070c95e1d5157608c Package appears to distribute a platform-specific binary frps linux-amd64 under a scoped npm name. Only two files were present in scope and no...

Malicious code in @pkgship/frpc-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 342b27b61267fcea7e459b9079bf0ab2eca982a2421c4d497685126ac6931d31 Package @pkgship/[email protected] is a platform-specific npm distribution for an frpc binary targeting linux-amd64. No install, preinstall,...

Malicious code in kvarzo8f3atestmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a85ccef88aba99ac71165f2b02e40f009e9ac8d25319da2abe5a712a1886ac47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdk-utils-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7619a01266c5e5b533601f9124beb17a426a17b5bc6f7c584e98c7d94a60defa Package [email protected] contains two files. No install-time lifecycle execution, no outbound network activity, no reads of installer secre...

Malicious code in @lumen-labs-dev/whisper-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9643145fda005627c853ce885fce2cba3f7c4ad008b8e3925fc2639b270567b The package was scanned and no a static rule matches or traced behaviors indicating supply-chain attack patterns were observed. No lifecycle scripts...