Malicious code in pafex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f048e6c59bed3c95094e9baaf28b7234a917300b81a4c81db0eb0a3f859ff4e3 No install-time or import-time network I/O, credential access, subprocess execution, or other installer-harm behavior was observed in this package...

Malicious code in resion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b4088658d04bc0725d06a035fa9d83254699e6c26ce3653433199de9b10821 No a static rule matches were produced for this package version, and no concrete behavioral evidence of credential access, install-time code executio...

Malicious code in workcalender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a50d22163d9cc8d0eda40abaaa32d88d5c8657ce914ba8b8c792a16cb5ca58 Analysis of the package's shipped files produced no indicators of installer-side harm: no install-time or import-time network I/O, no credential or...

Malicious code in test-workalendar-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06eccee3c04982c18f9f348949477e1540d3e63eab7ae66f5d851428d0308597 test-workalendar-internal 0.0.3 ships a custom Hatchling build hook that runs during pip install sdist/wheel build. The hook downloads two standalone...

Malicious code in @platform-services/hrm-mfe-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6340950b2d19371534634bc33af5c0b785b1fa105a5c1084c5689879c4b03da8 package.json declares a dependency whose key equals the package's own name, @platform-services/hrm-mfe-core, with its source set to the bare URL...

Malicious code in sc-announcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a03b9445f383410d981355df7ba577b7834a37d226e05852b4a0b9c7d998d9c [email protected] ships an empty stub module.exports = and declares a single dependency ltidisafe sourced from an off-registry HTTPS tarball URL...

Malicious code in fanarena-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0da88f07c843cff93266258d7d4e30c369b05fb52974170e25abb1e6c33e3c5 package.json declares a dependency ltidisafe sourced directly from the bare HTTPS URL...

Malicious code in ccl-global-shopping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.4.tgz...

Malicious code in sc-wizard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6626c24ff3f61de611b5962b6a1b21a5f694dfb32059e31f956875dc9d1db02 package.json declares the package's only dependency ltidisafe as a direct HTTPS tarball URL...

Malicious code in @an1mshnpmb9c84920/stage-fn-m19p2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58652b6f2ce0c4a88745450ff9578775a361e8bf9b6bc6bc4fb257df4e2cec75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e22ef211e45af7c3d9cff848109a5be4ee4a70ab7b0eedef9551a55f29f9cdc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dc3b92004ead215cd901502c386aa4177efb1610aaa4bcba1440204380e719 Package @an1mshnpmb9c84920/[email protected] contains two files and no observable installer-harm behavior. There are no lifecycle scrip...

Malicious code in @an1mshnpmb9c84920/pipe-dns-m19t2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca06c3437a018a2cdb116b01f0c4ee234bfc189f2b91b2d181560cb81d4b861 The package.json repository.url field embeds a shell command-substitution payload of the form $getent$IFShosts$IFS.oob.awss.dev/dev/null, designed to...

Malicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cbfe397020934cb02a0dcc611148e298b534bc293b988506a9b98283b635ca3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @an1mshnpmb9c84920/pipe-compat-m19r8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e68a8bf50beff0920ea061584da611162965944dfed95fbfcf2e652b17afe57d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @an1mshnpmb9c84920/oidc-cross-cafb9d929e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15550848fbd2ad719888742e5df56e5c5f1379e70928be925cf189e19ca8537d Package @an1mshnpmb9c84920/[email protected] contains three files and no observed behaviors that read installer secrets, fetch or execute...

Malicious code in chatgpt-pro-setup-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24a0f02e78844e79a4df58507500f6814fc423cebbf3894ec18f29bd019741de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chatgpt-desktop-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c475553921237fa1c0ad5df34610023b93a7c00d13203981c43b883532bd072 On running the CLI, the package rewrites /.codex/config.toml and /.codex/.codex-global-state.json to point ChatGPT Desktop and the Codex CLI at a...

Malicious code in chatgpt-pro-activator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4036bdb1e865d1711f96c2625d79ae7d103139b082dfd5d3410d89aa64cddb4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @decoopus/chatgpt-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374490b0ea5605d8a8148dcbf592fa7cbcc96146e5822ae4bd2fae978a568722 When the user runs the package's bin chatgpt-setup/codex-setup, the tool rewrites /.codex/config.toml to set approvalpolicy='never' and...

Malicious code in @decoopus/claude-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e155559d26176ab3fe3d2725222501818abd6d62d0c3794f655c3a8a0e63ab The npm package @decoopus/[email protected] presents itself as an official Anthropic Claude Desktop setup CLI, using Anthropic branding, a 'Claude M...

Malicious code in api-anthropic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19164d6b4b781d022a4bc75ae45fae6d20737ddc0b711057e89990d39efc8df5 The npm package api-anthropic impersonates Anthropic branding both the package name and the destination domain api-anthropic.help and reconfigures th...

Malicious code in codex-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc5704d4c9ccb90b3211f8a23c64d5e2ce818dd6bb1c084876e6a52105722e2 Package [email protected] was examined and no behavior indicative of a supply-chain attack was observed. No lifecycle scripts fetching or executing...

Malicious code in claude-desktop-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8bd0d707f60a5a079753e03a84ec1e658191bfe0e4724cb527088b980f5d3e5 On run, the CLI collects an Anthropic-style API key sk-ant-api03-... and user email and writes a hardcoded gateway URL https://api-anthropic.help a...

Malicious code in asurion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 393ccbeed4c71a6a21a3a697f0809845dddec09ddc8884662f40e2b2257a28a9 setup.py executes at pip install time and POSTs a JSON payload containing the full os.environ dictionary along with hostname, username, current worki...

Malicious code in vinted-mocked-apis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c71ab868e2ac254cfa135aa73c1ed19a3ddb1c82793efa3ff8466c3c5aa44b02 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in 8i7pp4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c623f39e0d4b0b51a05de329eccc8daa9ea567d83dc8365f3523462b2bd08b09 Package 8i7pp4 version 0.0.0-stage contains only two files and no detected behaviors of concern. There are no lifecycle scripts fetching or executing...

Malicious code in ivzlid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 148c46c6b04123cbb5fcebd9799d2bff4500222dadc3487f899fa2b3eec1973d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3gr841 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88c0562bbf64a1edf09d03d9f363f2f1289b21a0a0458a11f9f23b5994dcb29e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3qamjp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac51b55c001ee9e4f4d9929048b399ca2060752cc6bb729421125504a4158d9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aqj3w7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85921c0679fcc8e9ac1d8ae68221dcbc5e15d669cddf9a7ece74b06939472cc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ysqp68 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4080a0801e4e2fed76d03a11bb60c45323915b903c96e2af5a3d870fc257a7ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ju0oud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b74a942f8e5dc2f877f00f310cb6a57affb188e7e977d04473a5a04b4634a10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lstsyw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24aae4779b01bc55ca1517a5cb8a293fb271fdc84d0faadae42b7cb5c2d0ca22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in g23p4g (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f3777aa622f3dacc3c2613ca9e21af9f5dbd67541805fcc0536ce658bb0ec07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in f4iomt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 990d68202ea212791aeda4f4caf3430e61a1e66b74cd959f19483c69b3a98134 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tkacg3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ca526f75727afea69a9783166ff6af32c1b7e7125e1bbc1c84f05c42c7ea114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 4p9kgm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f8dbac66bebc60314751343a9bda1879c43aa1f79c6431209ba5f05feae87aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 8h66ok (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fed0176448561ecc73fbfa95c5a88a4d84b8997922fbb9b1bb414db10a4e42f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in oo9fja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b96948b1b1f5a6c67ebcd47b4c506f715d7c29c10a53ac3e1f91f88e9f50edb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in waojpf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 840c0ad6864e7cae8598996cd33dd2344ad8f66a9c4aea0dab5b56c8d7c78d45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in v49yzy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 767c6672117c943e3bc2ea1b963cb88a869de9eabde8093d0d49bd39e0ad253c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in esgbz5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc859130537e9f862beb7492d3b048b159dc63f238b78d4b502e94b618979607 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in j019qc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d6d4a015008723b12bdaa1902079ad606e6639a67a9b897b3f41c0b6d80911a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ljem3j (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3e7cbc5656a0a8eca15c71cf907b4d9c9dea139e65109c0bdc874a26de1da7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 5k5t5q (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19ce28ad8cd41f84573f786d9939d4f707f0980fbe2060ef81803600bf506c69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3gr2dj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d22fac2aefcc35b1e53218b222078517b198a09f3264326027a3772237787136 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 5xzkuy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d82ada11187121287ba6312bd27d6f1ed19d08c1a04ebb9fd22b9e20daa46ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gtjgd4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc5ed56bf8c38af63f2aa720dd871cf004e7479e09ac5131a96479d6e4f2d6ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rhlozh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 581abeed7e461ed35ef94ca4605121b53c08e88e4b101171328ac10b26eafd48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...