Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

Malicious code in @cryptosrvc/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host...

Malicious code in hyper-kube-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e6e8d8500ee41d92250882b57d98d805b381d2d08eeeac7bae55c3f5e417dff package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in poly-custom-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3263a9e2a986068fafa530a8e6862f9ba41cad05ecbd5b7b91752ca1c5af0c6 The default export getPlugin in index.js constructs an HTTPS URL from split constants pointing at the bare IP 46.183.25.232:45000/icons/108, fetches...

Malicious code in akamaijs-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a / / comment filled with...

Malicious code in remote_session_elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a2127d34a7d033e96e00a679891716647f0a00f7590ad738b43d985e83dda69 Package version 9999.0.0 is published with placeholder metadata "Shared utility helpers.", no author — the canonical shape of a dependency-confusion...

Malicious code in content-publisher-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3faac0139a1c2fd25d8b955e9290380bec365a1d3034fb793dfa723cb930463 package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance os.hostname, os.userInfo, homedir,...

Malicious code in crypto-javas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9 The package's postinstall hook runs setup.js, which enumerates process.env excluding only a small OS blocklist for PATH/HOME/USER/SHELL/LANG, collect...

Malicious code in relativity-foundation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d package.json declares a preinstall script that runs a Node one-liner collecting os.hostname, process.env.USER/USERNAME, cwd, npmconfigregistry, CI,...

Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in streak-view-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd index.mjs contains an indexCache array of base64 string chunks whose decoded bytes begin with the ELF magic and reference /lib64/ld-linux-x86-64.so.2...

Malicious code in rpc-endpoint-rotator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname,...

Malicious code in chai-as-rendered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process lib/caller.js that fetches a JSON payload from a...

Malicious code in eth-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper...

Malicious code in vscode-designer-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf384e12e957c8d6b3d0014504f652cd2b6f3885f49820a2907865566bb6137 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in wagmi-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...

Malicious code in cors-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1cff2c95bb175e36d5cb7a6e4880ed0f8816cbfb1dc7acef5d8173cf2cc40bb The CommonJS entry point of [email protected] exposes a getPlugin API that issues an HTTPS GET to the hardcoded host workconfig.vercel.app and pass...

Malicious code in shift-sdk-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aca555e012d36b30d9ffe3d0f8acdca7ba67298a87ea02ea9d32731e8f2a748 [email protected] registers a postinstall script that runs dist/recon.js on npm install. The script collects hostname, username, SUDOUSER, home...

Malicious code in react-native-ui-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...

Malicious code in table-ui-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a [email protected] ships dist/config.js, exposed via the package.json ./config subpath export, which exports a module-level array named HASHES...

Malicious code in com.db.dbk.ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c74649b28994f970d4972ffb8708378b355186eb729bf2e4c45d6acd16346e5d [email protected] is a version-inflated package published to the public npm registry under a scope that resembles an internal namespace. Its...

Malicious code in @offa/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8 package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname, os.userInfo.username, process.cwd, and the...

Malicious code in gekko-trading-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efc19985c853a3f4fdc8bdb1f08b432456b8f55ce701567edbf593fb3e6211c The package's postinstall hook runs setup.js, which unconditionally downloads core.exe from the hardcoded Cloudflare Workers subdomain...

Malicious code in express-middle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-sty...

Malicious code in caldora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 720ff44cbfe1253ad00e7fa884ee51d3961308d1a0e5c8b5ec7a05cef05b1b4b [email protected] runs a top-level async routine in index.mjs on import. When executed on Linux with /mnt/c present WSL and NODEENV!= 'production', it...

Malicious code in chai-assertions-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a83cd9353779d12538e8c6b06276178f6f0c246abd7d5148ce805536cbf57f The package is published as a Chai assertions extension, but the shipped code in index.js and lib/ is unrelated Pino logger source used as filler...

Malicious code in numpyp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 971ce16c4710dfddc439c30ec2fc190001171f79fcd66f718ad358a43ecdf876 Package name numpyp is a one-character edit of numpy top-1 PyPI package and PKG-INFO advertises it as 'the simplest module for quick work with files'...

Malicious code in opencode-engos-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274 On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos---baseline-musl, resolves each to the...

Malicious code in wallet-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc85c0238f90672b0cc329cae3487061924ed5a6458644a97cd90a830ace807 index.js exports a getPlugin function that issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/ and passes t...

Malicious code in ventrix-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b68f964850d0777c1f3993c52e3b66dc425b02ee82fb33bcd958514f730926 [email protected] ships a loader that, when the package's default getPlugin export is invoked, performs an HTTP request to the hardcoded endpoint...

Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

Malicious code in new-native-tools-linux-x64-gnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a The package ships a single 10 MB Rust-compiled Linux x8664 N-API native module tools.linux-x64-gnu.node referenced by main, with a two-line README th...

Malicious code in streak-bucket-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4145bc51e507e0a8b64d1267c16b0c9c8e80950a08bcf0a320b03fb8a1875b26 [email protected] advertises itself as a small dependency-free calendar/day-math helper library, but its declared main entry index.mjs is 521 ...

Malicious code in prokit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1f094f3b3aea4e6c087847823efe5c1f1a930ac746aa2696259951e6332f92 On require of the package, index.js unconditionally loads helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS...

Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

Malicious code in pfa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...

Malicious code in statist-browser-typed-client-sme.platform.mobile.voip.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb43194ddda04c3dffa5cb6bea02c8bc6edba8623acf172c5da744b2488e13b0 On require, compat.js selects a platform-specific payload path and downloads an opaque binary from one of four Cloudflare Workers hosts...

Malicious code in fb-forms-form-boilerplate-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bb3ca46733a388c550c5a1f6514c78b026447f355fcc669d1dfa0d58e8963a Package advertises itself as a form-boilerplate library but its top-level index.js unconditionally requires init.js, which on load downloads a...

Malicious code in @wololasod/tiny-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 string-array VM that, on...

Malicious code in viem-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32 The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey...

Malicious code in pfp-block-mobile-vacancy-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5 On require of the package, index.js loads loader.js which unconditionally executes init. init selects an OS-specific payload path, downloads an opaqu...

Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...

Malicious code in streak-math-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...

Malicious code in @mgor/fw-canary-3333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6 On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into...

Malicious code in streak-core-insights (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54c92b91e60c1852de5e84952155bf8aadca8ca1a0e7e784e0e1fa4d25e8c641 The package advertises calendar-day math but on module import runs an obfuscated initializer that gates on Linux + WSLDISTRONAME, then downloads...

Malicious code in pfa-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or...

Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

Malicious code in pfp-forms-sme-loan (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

Malicious code in streak-day-primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c4f0cfff000aa550229c0148bf96c70335e4d37048fa9f8fda3d4391ea2249b The package advertises itself as dependency-free calendar-day arithmetic, but index.mjs contains top-level code that runs on import. All sensitive...