Malicious code in ts-webplug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a120eb8e3f6ca34493b7f282544523ab60137e8388148b191f46cda094e50789 The package impersonates the pino logger README titled 'chai-mocks', badges linking to pinojs/pino, module export named pino while its actual package...

Malicious code in params-valid-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397af72237ba3626ac4727497662530f602c2ce6ec71406f48b508055687366c The package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate request package bugs URL...

Malicious code in tobihook (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c093ec7049ebbe26ca860033bc1fd81ad98f4f586b66fc68170e1ff81ae90bb The package masquerades as an HTTP helper functions named post/get/fetch, module comment ' request/init.py', and an unused requests dependency but ea...

Malicious code in node-path-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180db640dc8207694eb4629834f74b740d7efc9febf26067d190e10656fe04e9 Package name node-path-utils and its README/description claim it is 'an exact copy of the NodeJS path module', impersonating the Node.js core path...

Malicious code in req-parmas-valid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063b7e2667c434784d0b5d2ce333ea700fbc17571da3f5f4fc7d0f03ac406bd0 Package name req-parmas-valid impersonates the well-known request HTTP client description copied verbatim as 'Simplified HTTP request client.',...

Malicious code in sheratan_test_p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 472354ac3cd0bba5d399eea2f09e4b7f60cb2cb65e20d4af0f6398882403f566 On npm install, the package's postinstall.js executes whoami via childprocess and POSTs the output along with stderr, error, and a timestamp to a...

Malicious code in pathfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2527fa3618f01b694722f2a50297c248053dcdabf1b471ee9bdbdc6522bb838 pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an appended...

Malicious code in ogd-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1df5f4bdd6e2f58ff581cbad0d01738b5f6464794ace1a9fa95eea061a5bb7d5 package.json declares a preinstall lifecycle script that runs automatically during npm install. The script executes hostname, whoami, and pwd, then...

Malicious code in classbreeze-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e19daf4f946816f5ba3c6e592eacc980861b281c6752b738de57fdd31f49279d The package masquerades as a Tailwind plugin: README and the top of src/index.js are a verbatim clone of @tailwindcss/typography...

Malicious code in easy-day-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8602a5a154b50bb6351900a08fa45d7814c0f152e4379dcae53ccfa0b83db891 Package name 'easy-day-js' impersonates the popular 'dayjs' library, copying dayjs's author 'iamkun', homepage https://day.js.org, repository URL,...

Malicious code in @public-for-cdao/hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8611956b7ad849ba2a98285fa33897da931deb28e74f30bc8a6299d567852c51 The OpenSSF Package Analysis project identified '@public-for-cdao/hooks' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

Malicious code in cryptodao-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21c450a1d14c10213b83137f9c0670a9d8ed953105f96d66eedee78a56479d82 Package is published as version 99.99.99 to win private-vs-public resolution against an internal cryptodao-contracts namespace. The package's main...

Malicious code in cryptodao-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44bcbcde72a12ed60b3d16200226faa40f1e7e66c6ac36776710f2a0a3fec9a7 package.json declares a postinstall hook that runs recon.js on every npm install. recon.js harvests installer-side secrets — AWSSECRETACCESSKEY,...

Malicious code in cryptodao-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecefbb2ee777ab552f12fef0eab9af65f0a6c79f8a75a90f3df495a6746ec4a On npm install, the package's postinstall hook executes recon.js, which harvests installer-side data and POSTs it to attacker-controlled endpoints...

Malicious code in cryptodao-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...

Malicious code in cryptodao-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce8426b1d9dc5bde6547b58a21f2d3b519e56f7c2f948aa7e2173261532cee7 On npm install, the package's postinstall hook executes recon.js, which enumerates a hardcoded list of credential-bearing environment variables...

Malicious code in @public-for-cdao/abi (npm)

The @public-for-cdao/abi package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/config (npm)

The @public-for-cdao/config package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/types (npm)

The @public-for-cdao/types package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in cryptodao-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5323b2fc30e7603b402729f45345a9c3eb4af8361acaca5d035cc51f9e660cea package.json declares postinstall: node recon.js, which fires automatically on npm install. recon.js enumerates installer-side secrets —...

Malicious code in cryptodao-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b5f3b7ec6eecce3d891664f33660a1c612cdd3c6ac99ba52633ef77a2df543c On npm install, the postinstall hook runs node recon.js, which harvests installer-side secrets and POSTs them over HTTPS with TLS certificate...

Malicious code in cryptodao-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39fca1d76ba65e01fbd3319d6752bb0dc896f9cc356676c6bfad3671d8b1e0d9 On npm install, the package's postinstall script recon.js harvests installer-side secrets and POSTs them to attacker-controlled webhook endpoints. Th...

Malicious code in cryptodao-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dbe5f8614a264a8d3cdd2ecf8ecd2ad17292dbb5c5bcc25d0ae9d77eb8821df package.json declares postinstall: node recon.js, which auto-runs on npm install. recon.js lines 30-46 scrapes a curated list of credential-bearing...

Malicious code in cryptodao-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03ac58e81310f19b32d136445eab91f7ddc776921ff8dfd08bdb91bcdd4a1da6 [email protected] ships a postinstall script recon.js that runs automatically on npm install and harvests installer-side secrets. The script...

Malicious code in @mastra/posthog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68c0b320aa1f49ebdcdd16447b0ac3174bb2a81f46bca2740ca6eaca20f1accd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mastra/clickhouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea737d5664a4642538e7e34488a6b0a8df3156828a62e33ada84544a33b214b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/inngest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07e7e7bdee5f91bd1765d633b9afc7567f18b6577502df452ea633f3f71dd9e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/braintrust (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dc69743b21fec5f3b447419f86b5799d5216e1f1f16d96c8aba930d99514553 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590f8f6b10eff7b7dd626b6e382339b7122f26b43bae2ec5fa02801b0a710638 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/rag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031ec31035fa78e914e64884be3019150c8f1f77b9c464bce74e63cb0cd13227 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/fastify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ba29e7c4e2320b4f5852c18ded92c92021cfbc47d5bf8146b1a93ffa58260c7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/mcp-docs-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 477f5b90c17486d7cf04f5aa840c94a66509022040515038a955e610a31c88e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/langsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88a694522e378b42bba2d0e0b861c81f1d85201d685196237cce532d721fb8fc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08da35ae5d7bc21a7de70c2ed41f52a7a399a58fc26577835f8577fd0053136d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69bd7442a33e88350e5a804e238625a967b16df137b4b1623cd6a0587d25dc21 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/fastembed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3de0aac9c375829f2d4e5e18551958ee9000b1f9237f302c91178e0b52b8746 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8918dd16aca072972c93ebb866b08d6d5fda0b443955a2d4589ecbdbf4b87539 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/datadog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6becf49ea70ecc24e313fe6cd9f7a232df9465f3417b14de0f0002fcc170ab42 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/hono (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38c7b04ac71f0c234ec7105176bed53c8b893cdd89fd72465733787456601d0c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b30eb1bb672113816f02b78c98eb64ed613f49acdb94a706c7abf2418670f31 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/otel-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a8b6a73558d739f5ae803c6330009938e0a19f5c6a1a7c0f01cf4884fbea9b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/dynamodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2567710170942391d967675952bbdd9cd0f8d933cc39e4cf4460ca4c5b700097 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/duckdb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4754e9321d534c89f59052bd2ca5ce38c6d3916eba9a5e0990e0186c7beac14 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/evals (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9bc49e06e746f572e3d99fcd89abf22d51e094de6629cb9cce1988e2d3e08c4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/schema-compat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3037c66f9c4357ce9a1c2ec848e86eeef189f1b1a2c3f9f6c891963cf60049c0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/ai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98257d70b56e46a3dcd690478b15c54fb55c270db969b777c0cb42bec21ace37 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/langfuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f30e29c157bf23964dd09537f5c99aeb494c21ebce16d6a33b746a576a02566b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...