Malicious code in abuden221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbd19b84f2238fb96214c792d294b1ac0e114103c238ddf040a7960377d78f90 The tarball is a static-site / web-proxy build index.html, /assets/.js bundles with obfuscated names, a.well-known/discord verification file, brandin...

Malicious code in abuden22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c6b2d1b9158b6a3652850cdee84fd448567fc6d8187e685ee0b85eb8d594f57 The tarball contains a static-site bundle index.html, obfuscated asset chunks, service worker sw.js, and the MercuryWorkshop/Scramjet web-proxy bundl...

Malicious code in abuden218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36e1df12b592dc442d5266d4244831fd0b6ceb94c0960a26815f5fad3246b828 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in panrouter-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 390c706978c9207807a0aeb4b1e3dfc500847828c23f5ffb06a14171ca8e51e6 panrouter-admin ships relayclient.cjs, which connects to a hardcoded WebSocket endpoint at wss://jiuling.xyz/ws, registers the host with an identity ...

Malicious code in panrouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd8aaf176011a764d660ee547645c34815e959d39087519cd187c1ac1af2d53 panrouter is advertised as a 'Claude Code router' but on default invocation panrouter with no arguments it a installs and rewrites the user's Claude...

Malicious code in @onum-releases/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887866a4734ebf64a639f9d2512cd400085469ec7fa06aba5f1bbe340b2688b8 On require'@onum-releases/utils', index.js reads os.hostname and issues an HTTP GET to 'utils..200majoeu01dk02xnjdajro1isojc90y.oastify.com', leaking...

Malicious code in @onum-releases/shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c110ed26ad413cb298fa3f2ce6d435eda5521dfc4113ea5520478030ce063e74 On require/import, index.js reads os.hostname and issues an HTTP GET to...

Malicious code in @onum-releases/ixel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 188c65369497c00333fc54291c970071044f3237a255387903a707cfd2711599 On import, index.js reads os.hostname and issues an HTTPS GET to ixel..200majoeu01dk02xnjdajro1isojc90y.oastify.com/ixel oastify.com is Burp Suite's...

Malicious code in @onum-releases/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae207a349e4bda9359f4981d60ec81d9492cd8624535ee01b44c8f3bf3b3208 On import, index.js reads the installer's machine hostname via os.hostname, embeds it as a subdomain of a hardcoded .oastify.com Burp Collaborator...

Malicious code in @onum-releases/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d4bde1772d506f812e112fb8d6bfbf6a6f187dd823640f2cf15811f0d0633a On require'@onum-releases/auth', index.js reads os.hostname and issues an HTTP GET to auth..200majoeu01dk02xnjdajro1isojc90y.oastify.com, transmittin...

Malicious code in @onum-releases/api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07908d7f0abe458955357ed6814b46c090c70e1b3d34be4dd1a5c02d2507127d On require, index.js reads os.hostname, embeds it as a subdomain label under a Burp Collaborator oastify.com host, and issues an https.get to that ho...

Malicious code in @caspianph/storyteller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bd24daaa395f2e6bfae7c6e6f488a6e114b87e2606ec1bce7dcd4ab6a92f40a The package ships setup.cjs containing heavily obfuscated JavaScript with hex-mangled identifiers 0x32549a, 0x4b2b44, 0x78c349, 0x119ac2 typical of...

Malicious code in computerrock-babel-preset-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8987a1638ceebfb3dc8c8fc29e8e696fa15c6fe667697dfc367f59bf56b14cfa The package impersonates the well-known babel-preset-react-app under a fake org-style prefix and ships no Babel preset code. package.json declares...

Malicious code in metavu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc05e6833390f96b1a53f5d1612e613436e5002673da2f7a8c1e8e9f9f41c525 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects hostname, platform, architecture, home...

Malicious code in parket-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d62a38af75a45a91e590e0cffe4f58e900fe726b4323af1e481118d146277c index.js imports childprocess and invokes execSync with bash and zsh shells lines 315 and 331. Without traced reachability, it is not established...

Malicious code in final-poc-usa (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6cc39e355e69ec11b0532da1e2b2a418601a4c5594b100ba6f054f0e52be44be The OpenSSF Package Analysis project identified 'final-poc-usa' @ 0.99800.0 rubygems as malicious. It is considered malicious because: - The...

Malicious code in final-shoaib (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f67c342dc8bb7b3c1a396b89796f09865373db04cd9b08034e6087bf47b324ef The OpenSSF Package Analysis project identified 'final-shoaib' @ 1.0.0 rubygems as malicious. It is considered malicious because: - The package...

Malicious code in @rafaelsene01/agent-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3855afe87d31e428546f226e1da9236cd0e4dc45a477afb9f6ba1c707a4b05ec The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfuscator declared as a...

Malicious code in stackus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a8032b910c8971e79e7d8b0e250ce4d61fd2a2206d6b319a5aed50e32490456 On require, lib/writer.js loaded transitively from the package's main pino.js collects the installer's full process.env together with host identifier...

Malicious code in jwtmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b59454613cc025e514269f55b41a9da6a5da1db70e73e583bc79d97727e9528a On require'jwtmode', decode.js immediately invokes getThirdCookie, which performs an HTTP GET to https://jsonkeeper.com/b/AZ9ZF, takes the response...

Malicious code in requests-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfd9564690d64c44a730b088f4295c75b36e9d2fb164e2c7aa9ec2367153ada6 The package masquerades as a typosquat of the legacy request/requests HTTP library, copying that project's README, dependencies, and source files...

Malicious code in roblox-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06fae89087d7a50d6397199d5fe1d5fc925c7c353e72a7f8a84e9aeca08224e6 On npm install, postinstall.js fetches http://betterminecraft.fun/nettspend.bat over plain HTTP, writes it to the OS temp directory, and executes it...

Malicious code in intquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf4fe75f735c39be9ffe01686f69fd519c1408dd3473bb833506e1948fbc74a7 [email protected] is published under the name 'intquery' by 'Stagnation Lab', but its README is a verbatim copy of the unrelated project ts-logger-pack...

Malicious code in oem-agentic-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f612eb2fa947323c936a0bb1becc602f0f837f9023edac22a945470566386a8c [email protected] is a hollow stub: index.js exports an empty object and package.json has empty author, empty description, and no real...

Malicious code in datacamp-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbdcc4ef12aca6461f8e765976a7b2b33099a1791a7aee7e353371b7954a91c Package impersonates the DataCamp brand while shipping near-empty stub exports index.js init/helper return trivial constants. The postinstall lifecyc...

Malicious code in data-utils-bcf2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52e6ddf4cbc1a035918a5bd136c865ff526f430db21268d75d3c90fa74196fdf The package declares a postinstall lifecycle hook "postinstall": "node run.js" in package.json that automatically executes run.js on install. run.js...

Malicious code in stream-read-35cf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0597f71a1c39a743a4323636794601b480a1cda0c64df20d6bafa7ed601da84e Package declares a postinstall hook "postinstall": "node run.js" that auto-executes run.js on npm install. run.js imports os, fs, http, https, and...

Malicious code in data-utils-d703 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e172168e5ac500d10ae42718a87676ad44a589b31dbeb5f902ea7fb1c4e6a984 The package declares a postinstall lifecycle hook "postinstall": "node run.js" in package.json that executes run.js automatically on install. run.js...

Malicious code in type-check-816d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd3f7912317a2b9465a4c22ea948951f70aaa8c0d12f152572d43febc5667dd The package declares a postinstall hook "postinstall": "node run.js" that runs run.js automatically on npm install. run.js imports os, https, http, a...

Malicious code in metrics-probe-f256 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fdf2b93d50f09ea1b087bdc33578fedec5483e75c7a9acd61355cc02f9f7ec0 Package declares a postinstall lifecycle hook "postinstall": "node run.js" in package.json that executes run.js automatically on npm install. run.js...

Malicious code in metrics-probe-88ad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55133df30aa5d5678607d6f0a32d8b292c4fdf876893978a6785209304434fe6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in color-utils-dee0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d19450c3691562b0a498e497c1c6abde10e822eac4735cffc6f6513a7b471f package.json declares a postinstall hook "postinstall": "node run.js" that automatically runs run.js on npm install. run.js imports childprocess, os,...

Malicious code in string-tools-be6c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c725b56cc7e80c178e8d0fca3eceb069e811b979427b6ec99deab6b6f6cab8f7 Package ships a postinstall lifecycle hook node run.js that runs automatically on npm install. The executed script imports os, https, http, and...

Malicious code in fmt-helpers-794b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19b05306978ff506805f118049f81c74c5da1503bb34fd14a2a57d4e6faac52c Package declares a postinstall lifecycle hook "postinstall": "node run.js" in package.json that runs run.js automatically on npm install. run.js...

Malicious code in @ncurran/sandbox-recon-7c4e1a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1184134c86ce193b3abfb06949b3ce9ba51711e8e5615405d4f2ab63aa51a89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ncurran/sandbox-recon-880538 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b2312abdf908648141abd660e3384044ccd92cfdfd9ba75feb382aeb49011a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ncurran/sandbox-recon-sys-5f1b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f4f0ce20b0ebc74a6cc6447e493d56421999e17f0f980661c9baab280032850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ncurran/sandbox-recon-9b2d4f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e26a43461da776d8145183e606db9c9bdbfaa1a053e76c44ce1f78ec1364ec1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ncurran/dc-selftest-ba0ad4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 945bb6ebb1c34a64499b626b76d65ee3241c5018390eba029b3654bef389786c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ncurran/sandbox-recon-sys-6a3f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 608b0bb395714d269bf26dcde1f7863b0376062eb1b1707f2a7dd4dac279574b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ncurran/sandbox-recon-uac-4e7c (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 115efe1e922669b73488b969fea50128ffb8c0b8a5ef462d6c6319feaf1ce578 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm-sandbox-research-a1b2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd030068356281ae499fe6af7fd86ae10cac9f77f2f3fcc4d2d9abb67750be19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ncurran/dc-selftest-33afb7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66b28ace8d8604fc6ab7a05cf54cdae28480557c898231a79d71cab88eff7c3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm-sandbox-research-f1g2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd8a780bcd6850a1b4b810de411bf39db7f5b3f37e581a5a45d0e83215b0f339 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ncurran/sandbox-recon-sys-5b2c (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e23f53a4a0894697fe17ba0cb492b742f0cc7c213b99b42f455d608e14410ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-common-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1d3397d754ffeb3726496769b2f159ce8596b2233b5875afa8f7fbca29ed0fd The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a element whose src is hardcoded to...

Malicious code in uol-simple-api-futebol (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 962c38ed6ec061ce6a530aeea5a960dfc2b75caec56f7a1bc648f6b6cb655271 The package's only documented function, getJogos default export, unconditionally invokes an internal helper named prepareCacheMatchs which POSTs the...

Malicious code in ai-chat-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a12d35a8713a8f63eaf342901214a7f53fa396b9ee8218d246e5e0db7b6318 collect.js performs system reconnaissance and exfiltration to a hardcoded attacker-controlled host. The script imports childprocess, os, fs, http, an...

Malicious code in @hotcappuccino/nodepull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42e9bbd7a5cb25d0863ef140b42a7ab2abec1e921e18669eef3f07a91c3d6d99 @hotcappuccino/[email protected] ships a single index.js the package's declared main that is wrapped in an obfuscator.io string-array +...

Malicious code in @array-util/nodepull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcafb3a6336948fd12673cfe88d505e2a036afcfb5e9ee5d4b850cf982753d9b @array-util/[email protected] ships a single 19 KB obfuscated index.js as its main entry. On require/import, the IIFE silences process error handlers vi...