Malicious code in bigops-create-manifest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027d25851cc38da61b10c0ce1d722d3e8455826d2f7866474432e98dd8f1b806 On require, index.js loads polyfill.js which selects a platform-specific endpoint, downloads an opaque native binary over HTTPS from one of several...

Malicious code in tui-react-mobile-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30d6926a3b8c5bc55e60b4d4f98b2e06fb6c04608bb9442058516814dfb54f1b The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js...

Malicious code in beaver-ui-form-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37c4d60b5b32e6639dcecb7661afe72c6f5bb9ce486e53a398e81e11932f7379 On require'beaver-ui-form-modal', index.js loads shim.js which downloads a platform-specific binary from string-array-obfuscated Cloudflare Worker...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

Malicious code in tinkoff-boxy-desktop-features-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9792640803b7c90320c995d134baefcd36a52037d1947a3c0262c9d9e5ada168 The package's main entry index.js requires./setup at load time. setup.js assembles obfuscated Cloudflare Workers hostnames via array-join concatenati...

Malicious code in bigops-auth-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba54cfc2b542b8e388d852b80c0f409b2987423285eb6518d6dbc668e4c1a372 [email protected] executes an install-time binary dropper on any require/import of the package. index.js top-level runs require'./setup', whic...

Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

Malicious code in forge-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3784f08ba715b7afbeecfaa10b9c953b4406770c976bd07200977fa2f80b0317 On npm install, the package's preinstall script index.js collects installer-side system data — os.hostname, os.userInfo.username, home directory, DNS...

Malicious code in specials-mvno-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 852448e1055feb834486a41aaf7e1a621a52fc4e9a496f34c0bde833e751434b index.js requires bootstrap.js at module load, which fetches an opaque platform-specific binary from string-split Cloudflare Workers hosts...

Malicious code in tinkoff-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembl...

Malicious code in aedes_clusters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560 The package's package.json declares a preinstall: node index.js hook that fires automatically on npm install. index.js collects host reconnaissance...

Malicious code in tramvai-tinkoff-module-legacy-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06c940ade7f46d36a0ef00f120e2c6422c6ebc810c36429935ffd538da25bf1b On require of tramvai-tinkoff-module-legacy-popup, index.js loads setup.js, which selects a platform-specific payload from a hardcoded binary map,...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in streak-day-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch,...

Malicious code in data-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to...

Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious code in add-two-numbers-x7q9m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550dfc48a74577d95e53fc64cc296a9cc59a5940edb6eac3f191f41376350635 The package advertises itself as a trivial 'add two numbers' utility but its preinstall lifecycle script enumerates the installer's Desktop directory...

Malicious code in bigops-chat-tmsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4 On require of bigops-chat-tmsg, index.js silently loads runtime.js via a swallowed try/require appended after an empty stub class exposing...

Malicious code in platform-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c72999be0ce122b904fcb710f5438a0d1718a3d121dd1377123c5d710aa9e27 On require of the package, index.js loads./compat.js whose top-level init downloads a platform-specific binary from a set of Cloudflare Workers mirro...

Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

Malicious code in uibabai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2680f37e219fec8bf9af5b922534ccb483a6b0503d0158cccaa0c152ed6b7484 index.js has malicious code appended after a legitimate Tailwind plugin export. On any require/import of the package, the appended block queries the...

Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...

Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...

Malicious code in streak-map-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9123af3cafc613a53d0dc4ab34b30f955cab139b961dcd1c5f106e952332c3 The package's main module dist/index.mjs, executed on any import or require of the package, concatenates an array of base64-encoded fragments into a...

Malicious code in streak-metricsazb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4ea1b382140e833e01605ec5278b7a9a877aaaddd96ea9057efef2560b66b2 On import of the package's main entry, a top-level async IIFE in index.mjs labelled 'ENGINE INITIALIZATION & CALIBRATION' copies the shipped file...

Malicious code in streak-metricazbd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b On import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x8664 ELF dist/math-core.bin to /tmp/sm-engine-runtime/math-core.bi...

Malicious code in streak-test-mathcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1 Package main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via childprocess.spawn on any import of the package. The bundled ELF...

Malicious code in streak-math-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...

Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...

Malicious code in @tuluax/errb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561541f6fdbe9bd25716c6fb8a3326df9cbe7a78e7c972d89e36a1c9afc7a186 package.json scripts.install runs node -e "require'childprocess'.spawn'node', 'index.js', detached: true, stdio: 'ignore' .unref", causing npm instal...

Malicious code in emulative (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DN...

Malicious code in webdev-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9577d9f40486af224c5dd365ffbab6a5d45c4a052dfe6de50bc1d8f130d9642a [email protected] is a typosquat of the sindresorhus/pkg-conf library, published under author 'Sinde Sorus' homoglyph of Sindre Sorhus. index.js...

Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

Malicious code in simple-date-formatter-util-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693 Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script...

Malicious code in @zzzgenesis00/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...

Malicious code in @zzzgenesis00/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc49c7ec56350694f458d9468efb51a30a9ac20ff490ac44b0cedd8bbbe004a5 The package is published as @zzzgenesis00/etherjs with author 'ricmoo' and a description mimicking the legitimate ethers.js library. On npm install,...

Malicious code in @zzzgenesis00/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3 postinstall.js runs automatically on npm install and enumerates installer-owned secret material: SSH private keys under /.ssh, /.npmrc, /.gitconfig,...

Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

Malicious code in @zzzgenesis00/solana-wallet-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46 The postinstall.js script, which runs automatically on npm install, harvests a broad set of installer-owned secrets and identity data and exfiltrates...

Malicious code in bigops-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...

Malicious code in eacq-payform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare...

Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in entropyeasybots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111,...

Malicious code in @zzzgenesis00/hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9f452c698c4accd69ca2df75854aae3189ecf3dddafc4b62d86403ca3d911f On npm install, scripts.postinstall executes postinstall.js which harvests installer-side secrets and host reconnaissance and transmits them to...

Malicious code in @zzzgenesis00/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ad59aa1c004d723d6e24f8113d8f3d45728c0b26fc41531ec00c0f91d2ddef The package impersonates XRPLF's xrp-lib author metadata and homepage point at github.com/XRPLF/xrp-lib while being published under an unrelated scop...

Malicious code in simple-date-formatter-util-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c4633742f36d29ca968a2ce71c97cb81e9cb2d2c76738742bb39de671cb115 Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launches a backgrounded interactiv...