Malicious code in vantora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 530a2162909707ce34212e910d9a625ad0a4a6a746a7a48f5e3f3523b3b3df23 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in caldryn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c9fe8dc148d9aeea38bde81a4c2c467769c550580a8394dbbef1152aea36ca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in veskr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af373607b79177ffadde79de1f78b4c5490a04cc5cdf41a925cf42e234fc867a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vectormark (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 966fb5c08bb39dca42e48787fab3b7c14e38afc4ae209f5cd6231acc10d05c72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-tabulix-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 413e61124e5f46f550114ce54d841c1dc68b4dc3a9d0939c8f3c021a6c790a65 The package's package.json preinstall script runs dist/index.d.js, which base64-decodes an embedded payload and executes it. The decoded payload uses...

Malicious code in react-tabulix-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...

Malicious code in dev-helper-bg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce930400319131adb4adf9f442340165a52a3ebd8320c497d1de05a3f896cac3 On import devhelper, devhelper/init.py calls startdecryptor at module top level, which spawns a daemon thread running decryptandrun. That function...

Malicious code in make-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 39bf40d5056dc821bcedf5fcc304e26d9e6566f5beb508b6a01874b49d32becd The package embeds encrypted code that, during import, is decrypted using an externally sourced password. The recovered code is executed and starts a bot capab...

Malicious code in svelte-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b07b98d6a7986da479ed75708e37dfbff0df7a6ee136f7dad1db24087bed2cf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-daycount (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5a02c91969e01fc57050b8fabfc6abe2e50b9455cdaa4357791d24546b5623a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...

Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1e0d9d996b5aaae14084ec54f9bd48bdfc6399673f1203aacebdef8abb42692 On npm install, install.cjs runs a postinstall lifecycle script that, on macOS, writes an AppleScript to /tmp and invokes /usr/bin/osascript with 'wi...

Malicious code in comp-colors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1aad1b8a73afbe28c708c4e19a1495793d1214980f72357a13d07b98f1f9a060 The package hides code to download and execute a remote executable from a newly created fastsyncapi.com domain. It is disguised as a remote 'fast color helper,...

Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4618cc8c89ff606f81079aef2e98920220ca9e59ec284c8d6c18167208604a3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

Malicious code in react-tabulix-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e1730bc033ffe3e5cbe24819446e0c6d41af7bec46ec931a04eca2909ffc7cc package.json declares a preinstall hook node./dist/index.d.js that runs automatically on npm install. The script at dist/index.d.js decodes a...

Malicious code in animated-octo-spoon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 52fb3a0200c7b61bf5fc682f4d07d707c8793eff868ee0d2877de539bddd62b2 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

Malicious code in react-tabulix-virtual (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbfc5a819e6dfbc3c65ec83a79a9f93a95da71259279c54e95f34c36ab81a22f The OpenSSF Package Analysis project identified 'react-tabulix-virtual' @ 0.1.1 npm as malicious. It is considered malicious because: - The...

Malicious code in react-tabulix-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7304f03532008ba586815d08fdfa9fabde3615481804901bf96cba75fa38a1bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in reimagined-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

Malicious code in lebinfmt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 448ec8ad7c978d60f142f12780be3bb6ae7b90870fa4c2bf2d50ca7d4111cdfd This package is prepared to perform steganography decoding using the same code and was published on the same day as package 'rasterkit,' later used to deliver...

Malicious code in colorstack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e622a7f45c572488da7a3dcea95a8deb6a56b0dfd843cd85483373bd03fb8974 The package hides code to download and execute a remote executable from a newly created fastsyncapi.com domain. It is disguised as a remote 'fast color helper,...

Malicious code in rasterkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875 This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an...

Malicious code in rasterkit-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 29eb6057bbc11a0f0180a030db952f9ec8aa39ce8c4b0d437046b20301f5b21a During import, the code uses steganography to extract code from an image hidden in the dependency. The code then adds a new authorized SSH key and reports back...

Malicious code in fluffy-octo-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ed721bd4c1baf8e69a7f3c5039ac5644b8c6f0795e87fc711d3cd2b0a523c1e1 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 186ad60c2221871a68cd4513fc2d2295a0595156cdea7615a49de03572f2e8e8 The OpenSSF Package Analysis project identified 'commonweb-rewards' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in consumerweb-calurls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3b11cf69cfe3f87442591bf436e6905273bc84de3171c27102b63406c0fe3235 The OpenSSF Package Analysis project identified 'consumerweb-calurls' @ 99.9.1 npm as malicious. It is considered malicious because: - The packa...

Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f81c6e2e081a09ccd8ad4ade2f34c142e2f0db5566c881ca78acaff3e4de84a The OpenSSF Package Analysis project identified 'commonweb-card' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 84f718c6b68fba15ac3506964439bc33c409cef1390f6cb22fa5a86d074e3a42 The OpenSSF Package Analysis project identified 'commonweb-moneymovement' @ 99.9.1 npm as malicious. It is considered malicious because: - The...

Malicious code in signzy-field-level-encrypter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1620206c32062d89cd35aa65951fb139a004cf78c5d1b0b6eae1e7fb7378238e The OpenSSF Package Analysis project identified 'signzy-field-level-encrypter' @ 12.9.13 npm as malicious. It is considered malicious because: -...

Malicious code in commonweb-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8b9102a57c949a7d21c76cda6949084c43fef8fa77441dc6e2802edb14161b32 The OpenSSF Package Analysis project identified 'commonweb-wallet' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in cxpw-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bab7a1da929ef8a5ecad197bb450f0fc908d3d486604672e9a71a7d7a1919389 The OpenSSF Package Analysis project identified 'cxpw-offers' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in requestor-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6d4229671aa9a57f0ffbe61cd9ebe925c0874f55dd72d15f43adff096d0cf3f0 The OpenSSF Package Analysis project identified 'requestor-util' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38312fd425c2921477fe6eecb5036500bcdbc1735dee43f3a84cfcbf2ba3002f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2001f9e400a8a00d732bdcdfc5b0744420a7595ec39311cda805ca53fce035ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

Malicious code in trongridmy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 17d343778bc5b25dea876fcf592e8e0267c3ec189ea931a6c73ab536894aabee Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d44486dc374cb50abaad84a7086859ce3c2a7e5b17a790aae5b426c4cf2a1e0 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in upjsma (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25730cd7d45983434b20869fb88d5b84fd468d20341080c44adbc2c53778cb3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in roles-royce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378 rolesroyce/init.py invokes a hidden checkenv routine at import time that spawns a background thread harvesting installer secrets — SSH private keys...

Malicious code in defi-kit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d On import defikit, the module compat.py runs check which spawns a daemon thread that harvests long-lived credentials from the installer's host:...

Malicious code in tilaver-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...

Malicious code in s3-lambda-dynamodb-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6517c8914c4ba64ce57809484229df7fbe5dd9f5129c40b19cec8a73c10a70ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alb-lambda-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18b4d2c02af6232b1a73b084148490b5d46143eb883aa076d55a386e62839b3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iot-kfh-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d951dbac36ed1916b5dbff7333d074898752088132c2ec6e2b12fe223b835393 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lwc-slds-lbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1012357081d7f64d29bd6ddbe25552eabad3448e18c5a99a931cc1b20e31d072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lambda-cloudwatch-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12706a5899ff9e1862dfc4ff260b38860415e8e68511e7e7f8d98bd5d6406e04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in automatic-octo-invention (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9601d13b646d0f31e4053a8f1d2b159cba6c30b1860a67da0baa3d7d7086d9c4 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...