Malicious code in sauruslord-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 474b90ec19af5dbbc5bf3c8d27c0c4d079c7d980d6e3316dad3bbf5682abbe52 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in saurus-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c66bed79555a8ded86c45232c26e4b94785b5789d2b681a93e92c93ef95eb966 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @debile/require-dir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3075732c05c8b941b57fed9e8fe9c788b28f9ff6fe9ef91936d1802f568c594e Package @debile/require-dir republishes the code of the well-known require-dir package under a different scope. Its package.json preinstall script ru...

Malicious code in gmail-changer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913e56ded5b9c46e15c7589a0883bfb708b2488aa54f4c25ca05b1c13e4d75fe Package exports a complete Gmail account-hijack pipeline driven by stolen session cookies. Exported helpers waitForRemoveRecovery, waitForRecoveryAdd...

Malicious code in monogrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3369fb16804682addfec56904223d0255c2a0ca6d35481e744221e8252f2000d Package publishes as a generic 'M!T' library with an unrelated Apache-license README, but the tarball contains an offensive spam / phishing /...

Malicious code in core-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad83962ee4db02c1bf43558ed5fe6bf79f66754b070415223d29643a8ff754e core-dotenv presents itself as a dotenv/env-var wrapper. On calling the package's config or get, which lazily invokes config, a worker plugin.worker....

Malicious code in estore-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...

Malicious code in ogensec-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4acb9448e8289c41cb35a883074545d2a790b719104b2f7c9a99bfca3e3f64ff The package ships an Express middleware that, on each incoming request, POSTs appId, endpoint to a configured $baseUrl and interprets the response as...

Malicious code in creditgauge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0bd064afe94f426f1124703c1c1f7ac52ee1ad1df728c33ce7cbe4328bae876 The package has no functional library code: package.json declares main=index.js but no index.js is shipped; the tarball contains only package.json an...

Malicious code in data-proxy-for-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cb07f37b05b892d9785cc03fba0754ea4af3a50fab0ca6bb345ecac52b939a2 Package distributes as data-proxy-for-test while copying the identity author Sergey Parfenyuk, homepage/source pointing at...

Malicious code in ethereum-input-decorder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94137fcf0aee7d8edb4e15a8bc9be4455fbdf79cb5bf99987b79f0393fdff62c The package name typosquats the legitimate 'ethereum-input-decoder'. Its top-level init.py unconditionally invokes a payload routine on import: it...

Malicious code in polygon-toolkit-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f56f0404b5e3f35ed475dae417f9351d4d149e163598eb72380fb6c025099e12 The package presents itself as a web3/polygon validator but its exported API silently relays caller-supplied data and generated cryptographic materia...

Malicious code in webpack-session-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0007695a788bff7d6d0a87ee48de6771c12a1e21241bd3fc0bc7b5509608533e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in polygon-toolkit-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c3f2f27ce890479049767726c06bf083f96fe5c9916f43f5345f62ed9671c1 The package exposes validatet and randomBytest,e which route their arguments through an internal checkvalidator that base64-encodes the value and...

Malicious code in @bcs-mi-ui/message (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6f4bc902c3be307322df1b9d7f35ffae7ac2e7b0cf6d0cd2799adbb90219471 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bcs-mi-ui/message-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58c86304011c297c4b10092f83a6dc1763b8174e91fd9e81f8487b959ecea539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bcs-mi-ui/test1243npmpacket76 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9e1e6c4d6beaeee572dffd24a67ae5bc74026eb798b1677a1dfa52144e15aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b0bed6337ffe527af2615fed8ae1ecbb449f6a6cb00afa6381f7811ec88956 [email protected] ships src/poc/index.js which uses childprocess.exec to run a shell pipeline that collects host reconnaissance data hostname,...

Malicious code in ai-explain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2b6beb476c828df723da0a2b4b524cf671e2eed9223a6e04c45c0ec4d59172 [email protected] ships a postinstall hook dist/postinstall.js, mirrored from scripts/postinstall.js that, on npm install, collects the installer's OS...

Malicious code in ai-pro-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...

Malicious code in @hkyyy/portal-widget-helper-0601 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72e27d8bfbf5b9bfefe661d642be934399a38031c1bee028a20ed3282e0f482 The package has no real functionality — index.js only exports ok: true — and its sole effect is to run a postinstall reconnaissance script...

Malicious code in @saladin0x1/js-shared-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b34c6719686343f42df5a2257649104f50ac91ae01ac81d34f182075dc943ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

Malicious code in chai-as-byte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f On require of the package's main entry, index.js detaches a child process that runs lib/initializeCaller.js. That script posts the caller's entire...

Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

Malicious code in @react-case/option (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beffda94b8ea554f153faaf508da7906f78d821d45d2fca7b7b61180740269 The package's main entrypoint index.js is heavily obfuscated with a string-array + RC4-style decoder that reconstructs all API names and the target U...

Malicious code in mc-reg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93ca15954536abe30ea5c7f5bc5a06192f3946c98d74edef9d90edbc52cb9d95 mc-reg advertises itself as a Cosmos chain-registry data package README shows chain-registry-style assets/chains/ibc API, but its main and ESM...

Malicious code in proxy-checker-j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual...

Malicious code in iwsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in cppt-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484688d5963a9246f4fe7a2b5c1c7ebe6bba135a2a5df66b3ab57f44978407b2 [email protected] declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js collects host and user...

Malicious code in json-bigint-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bfb97f2d263cd34365f40866529d6c55ee567f38b5d5571ce6b16e49469bfc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vite-js/vui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89dd59b0cc2b2931e47b1822fa705eba41767d28ae89bce2e277254377dd9a0a Package publishes under @vite-js/vui while impersonating the official vite package: package.json sets author "Evan You", description "Native-ESM...

Malicious code in chai-as-structured (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9508b72d48575443d9e68f1da1ef6bdd1ebc9351f271fba56b563701f03e56e2 The package name evokes chai-as-promised but the shipped code presents itself as pino middleware. When the middleware factory in index.js is invoked,...

Malicious code in chai-as-hardened (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20c6afe564cf46f02258e635c1b08a802cd4f9b949e098710f44544cdbb86dfd On require, index.js spawns a detached Node child process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL...

Malicious code in http-ws-listener (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b70acc8a626218c5855ef656a6945f1f2018c0ff62c112d9b31bae5016fae49 [email protected] ships misc/configFetcher.js, which reconstructs a hidden Pastebin URL and the module names 'net' and 'childprocess' by...

Malicious code in ahooks-3.7.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6816bbe8dc3e7d033a03452f7c1e8f873b97c158165faa863694ee13eb6dd61 Package published as ahooks-3.7.8 at version 13.1.1 with empty author/description/license impersonates the legitimate ahooks React hooks library...

Malicious code in postcss-selector-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fec62079856815ded46ba283769d3d3e0d20e08b6196b8698e08e2df6677ee Package is published as postcss-selector-minify a word-order permutation of cssnano's widely used postcss-minify-selectors and registers itself to...

Malicious code in tronwe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 112f4650a3896e1593be067762ad3e62bd36fc2b1ed65d9f02819de80d012880 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in cosmos-gradio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bf1266e0846a392e9aaa6805756d26dc427a04415e8a422d53ffce7a1a0c2e2 cosmos-gradio 9999.0.0 is a dependency-confusion squat published as an sdist-only release with an intentionally inflated version to win highest-versi...

Malicious code in cosmos-cuda (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a96e5776ec64356f639738134c95a2f33233a4275d2d0ddd6b174c297c64ee The sdist-only package cosmos-cuda 9999.0.0 executes a beacon function beacon'build' from setup.py during sdist build/install and beacon'import' from...

Malicious code in ethereum-lib-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58bddf420dcb894a940b62fba777628f0c3a9d31dd7fa915afaea618c1914d52 Package [email protected] impersonates the widely-used ethereumjs-util library: the package name, README badge, repository, homepage, and auth...

Malicious code in assertion-utils-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311d22d9694863456136cf4f8b69a291fdbb631eda56bafca1959e0c184774a1 assertion-utils-js is a typosquat of chai name, description, and keywords mirror the real package. On require, index.js spawns a detached Node child...

Malicious code in smb-common-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66072ca2fc20c19a01d0a2b888d90632a7d9bfdc34a2d1a71b61ad06975eae5c package.json declares a preinstall hook that runs index.js. On npm install, index.js collects host reconnaissance from the installer os.hostname,...

Malicious code in smb-portal-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 395b88ae26544dcfdfca9d46294e1f0558c2e5bade88bac0eb0797d1140debbe Package [email protected] declares a preinstall lifecycle hook that runs node index.js. On npm install, index.js invokes childprocess.exec on...

Malicious code in @web3-helpers/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225 At npm install time the preinstall script dist/index.min.js reads installer-owned secrets — /.ssh/idrsa, /.env, /.env.local, /.wallet.json — and...

Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

Malicious code in @radivi-ui/react-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e92ae03eb6adb090fb832665431984cccef31039bb920e3850535f4defe610 @radivi-ui/react-dialog is a typosquat of @radix-ui/react-dialog whose main entry index.js is a self-executing IIFE that runs whoami and hostname via...

Malicious code in chain-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb94ce743d92fe81015db70380ba325e78e4271b78689a9a6998cda4e6bdc038 chain-sdk-js is a typosquat of @thetalabs/theta-js package name, description, author 'Theta Labs', and bundle filenames thetajs.cjs.js/thetajs.umd.js...

Malicious code in chai-as-act (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf85a5e85f183a28cc32ff39ddcc68ef15b698cc62eccfaa89dd1bb80c709f6 The package masquerades as a chai plugin but ships the pino logger source tree plus an additional payload file lib/initializeCaller.js. That file is ...