Malicious code in voxilaratts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913b23ea87926b9e184f9e02b7d817486565fdc4c81fd0bc7cadda2fb7e2ff5a Analysis of voxilaratts 0.1.0 on PyPI produced no indicators of installer-targeting behavior. No install-time or import-time network activity,...

Malicious code in brummatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b780cc0f3d918e82d8f9999cba10b7188b785d2c42a1a7bab2bc2f693e21c2 The brummatts 0.1.0 PyPI package shows no code paths performing credential access, outbound network I/O to attacker-controlled destinations,...

Malicious code in melcuratts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01116dad2488eeeb0e57fc2ae314e507b8cb8aad04245f54ddb89eb2f019441e melcuratts 0.1.0 contains no observed install-time or import-time execution of attacker-controlled code, no credential or environment harvesting, no...

Malicious code in quillonatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad09c871f903768f458b780fd73be2cea587a7217ace4c10fa46941883e905d The package quillonatts 0.1.0 does not exhibit traced behavior consistent with supply-chain attack shapes. No install-time or import-time outbound...

Malicious code in shellgrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd3a56dadcead9c70f46d3985afa55cfd99daf25d9a51f737fbe8fcaf4a09103 Review of the shellgrip 0.1.0 pypi package did not surface any evidence of installer-side harm. No install-time or import-time network activity, no...

Malicious code in batchspar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab64feb6e332be8ba2d37c9d1efdc21148c1e9b0ff1f849bd35d33dee2602a4f Analysis of batchspar 0.1.0 surfaced no indicators of installer harm. No install-time or import-time network activity, no credential or environment...

Malicious code in crenelatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc72e2a3431d0207f23fc8a8bdabadf7cc9fa262a15a25a31c2ca30a71a9eb38 Package crenelatts version 0.1.0 on PyPI contains 13 files with no observed install-time network I/O, no suspicious lifecycle execution, no credentia...

Malicious code in journey-test-hellospy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 418fea1fe789e9a44c77c08c9135b3da66b773882c9fb2757094c3f55b04321b During installation, package exfiltrates potentially sensitive environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, lik...

Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...

Malicious code in @sudobility/indexer_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...

Malicious code in @sudobility/wildduck_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 U...

Malicious code in @sudobility/shaperouter_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

Malicious code in libseal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e8ebbbca9850ab1485e13a15b5425b0c7c823adaaf480881ae7223ffdc254f Package libseal version 1.1.1 was scanned across 20 files with no a static rule matches and no traced behaviors indicating installer-side harm. No...

Malicious code in iterquarry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c408d2ad5c91bc36fcf3fb32c9649828b6c358f6eb0f32d71a18cfdc226c604d iterquarry 2.1.2 presents itself as an iterator utility library but is structured as a thin facade over a sibling PyPI package 'libseal'...

Malicious code in zzhelloworld_socktest (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f On require "zzhelloworldsocktest", the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768,...

Malicious code in @worrisome/aaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec97c3a98e2a1d17f7d4d004dcf477622b436fcde85663875f7b52e35a46725f The package consists of a single index.html file declared as main. It impersonates a Cloudflare Turnstile 'security check' page and, when loaded in a...

Malicious code in journey-test-helloshell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0203fffc73ebe748d6defab0472b648408b29c959a9c6813f966df48cfafb21b setup.py registers a custom install command cmdclass install hook and also fires at module import that connects to the hardcoded bare-IP endpoint...

Malicious code in test-brotli2-testmetest (npm)

test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in pixel-map-testmetest (npm)

pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...

Malicious code in test-brotli-testmetest (npm)

test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...

Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...

Malicious code in data-pipeline-testmetest (npm)

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun downloaded from GitHub...

Malicious code in peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dcee06d04730b1752735a588708d307ce8f1a223274c4b5471ae96230a1d2b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in moveworks-capi-starter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...

Malicious code in my-auto-follow-eltio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6f6e8fd17c3c20b0dd9889e9ce58ae2222c659d4af55e16024711c6c531b335 npm package [email protected] is a fork of the Baileys WhatsApp library. Two of its source files, lib/Socket/chats.js 140 KB and...

Malicious code in @alannxd/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2dd15da8d647385c59765df516101c97dbd343f01574a204a87b8cdaeaef3c This is a fork of the Baileys WhatsApp library. On every require'@alannxd/baileys', the package's main entry lib/index.js performs an unconditional...

Malicious code in ssemver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6aacc4af4fb66d334fa0153d79a707cf0c3decfe3d3b7ed41c67697f21d8b16b During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in semer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7479f42de6f963e39b7aa1409b586e605dca69978763ab35236d20c9126aa4f1 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in debbug (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 082b90f5908b0452f00e213182ddaec147cb8f9c49b25fcb4ec4e1533eafd9ab During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in deebug (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 db7aff856cffe15877311c77e380d51572713e5eaf35aab77ae51453025a352d During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in tellyo-colours (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcb85c2aba3b12a48393163cde3c6b1d3fa946d4f3745347791ae25ac216b86 [email protected] declares a runtime dependency on abbishal-poc-as-dependency with the wildcard version "" in package.json, despite the README...

Malicious code in hijok-lampam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1617f9fa63812c564b7738c254770f05497cda2f13ed308855a86752f962655d hijok-lampam 1.0.0 ships a 40-byte stub module and declares its only dependency via a direct URL rather than a PyPI version range:...

Malicious code in trijigo-kalip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 37ff57e1b55bd5e84d85338fd9b0b43ae1faf44cc8a7e0e3e11387663461d52d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in jiklpo-tsunari-kay (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2df8ddef194a109b65d938d86371d9e97c84ea4c8863af380fb495508ce5a90 setup.py declares installrequires="object-handle-logger-table @ https://artifacts.yosiroute.com/pypi/objecthandleloggertable-1.0.0.tar.gz", resolving...

Malicious code in hijiko-pilaka (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618fc4257600bc10efdde21aaa2bfe35b4e2138a4c2ea6997c4e1b0daac4b55b hijiko-pilaka 1.0.0's setup.py declares its only dependency, native-delta-field-walker, via a direct URL to a tarball on artifacts.vacsdk.com rather...

Malicious code in facewareretargeter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afcd41ab1e378f4c7d767acb2b9e9199a4276e125d6e84aba3627bf37c879f24 facewareretargeter 9.9.9 ships a 2-line stub module and a setup.py whose installrequires declares a single dependency, tracer-batch-stream-chain,...

Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It...

Malicious code in rs-lookout-sandbox-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c On module load, index.js reads os.userInfo.username and issues an HTTPS GET to a hardcoded third-party collector at...

Malicious code in memories-core-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5aa2bc32ff519468287f8a87deeff1349332b710735b9f78ee34ffd46c9511cb package.json declares a preinstall lifecycle script that runs curl to a hardcoded webhook.site collector URL...

Malicious code in semvver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyup...

Malicious code in semveer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install...

Malicious code in semmver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de323d5976a26f2d9540680d1706a53bcb3ca743409821e83f7a2f1b60e8594 The package is a typosquat-style empty stub semmver/init.py contains only version = '1.0.0' whose only functional code is in setup.py. At pip install...

Malicious code in semverr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110e0a64dd80654ca98caa5e291499d158a39eb66c1d35efe896a42095c85118 semverr is a near-empty package a one-line version whose name resembles the popular semver library. Its setup.py runs at install time invoked by pip...

Malicious code in nwfp-build-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905a5825cb8abf7b385b98cfade02c315a4bc776bc37cfacd5ab20d5b8d03640 On require of nwfp-build-config, index.js loads lib/telemetry.js, which immediately runs an IIFE that reads the installer's hostname os.hostname and...

Malicious code in unicode-title-normalizer (npm)

[email protected] was published to npm on 2026-10-19 at 14:50:39 UTC by the account bluntyblunks, about one minute after npm's staged-publish placeholder 0.0.0-stage. The tarball has three files. index.js exports a function that returns the string "hello", and README.md is an unedite...

Malicious code in formatting-subtitles-for-claude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f683c00ef9c42d55e37cdb367179f21e58ce2441dba55485d6d19670bcefa700 The package declares a postinstall hook sh./nodemodules/unicode-title-normalizer/x.js && exit 0, which runs arbitrary shell content shipped by the...

Malicious code in security-research-startup-snapshot-810764b303 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c7f807a5943ac03cda3bdddc675ad3192d210e1f0ba1300959feff5d1d29c915 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on...

Malicious code in research-probe-6150c1c915 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3696b3aaa62ad07c027d3471a6061628fe63f07faa135887342362ceb424e604 The package ships a .pth file that imports researchprobe6150c1c915.boot on every Python interpreter startup, with no explicit import by the user...

Malicious code in workalender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb4f2824499fd64a22d9dfdb23c454bbb8797422f5281fdd5f454ea64095853a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...