Malicious code in lite-matterr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9b5f5edaae9103fd26de7cb70e661d78d6948dc3c519fec6b4b62fd471fbfc [email protected] declares a postinstall hook in package.json that runs wscript.exe 4444.vbs on npm install. The bundled 4444.vbs is a 765KB heavily...

Malicious code in lite-mater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 532663c4102d3cf7310e29ca1eb2b389c5c32c1e541da219b7c4364968f4e807 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs automatically on npm install on Windows hosts. The shipped 4444.vbs...

Malicious code in oleh-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2aebc282014a7dfa6ef1726083d23bcc9cc3eca76c814d4e775b7b10021545 Package [email protected] is a credential-harvesting phishing kit disguised as a wallet-connect modal component. It renders fake...

Malicious code in minimal-a11y-contrast-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance...

Malicious code in monitoring-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee The package exports an Express middleware monitor advertised as a monitoring tool. On every response finish, the middleware POSTs the inbound HTTP...

Malicious code in postcss-gap-fallback-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5 The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs...

Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

Malicious code in tiny-viewport-unit-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e The package ships thunderboltRegistry.js, a module that imports Node's childprocess primitives and executes whoami plus repeated ping commands agains...

Malicious code in promises-dotenv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 146d9688d00e8fa785e2fb62976f0dad169e8055c6c92d3795536cc63527c640 [email protected] is a typosquat of dotenv-family packages that executes an obfuscated payload at module load. On top-level require of the...

Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

Malicious code in studiocode_tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 261d413c0847b530c9a452c209c25e0a7d9123f9b0f20b26d0afcc41a929c74a package.json declares a postinstall hook that runs wscript.exe 4444.vbs, auto-executing on npm install on Windows. The shipped 4444.vbs contains...

Malicious code in studiocode_eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49b1af8bbf0463bb38d3049e59c28b0dcc8d2e3e5ef54611b4e77bddfdd36dc package.json declares a postinstall hook wscript.exe 4444.vbs that automatically executes a 765KB VBScript shipped in the tarball on Windows...

Malicious code in rgx33-flex-layout-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02200327d66cf0661b787f58049b55b5fbb95dfb76fbb81a679cc71439bd85eb Package name and exports thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc. impersonate internal Wix thunderbolt registry...

Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

Malicious code in tiny-dom-focus-trap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84262096595a1e0ce09bbaa359930cd07cf420cc72545174ddc4f12c60bec962 The package is advertised as a focus-trap utility but thunderboltRegistry.js runs an IIFE at require time that uses childprocess.execSync to run...

Malicious code in tailwindcss-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 587d9a389f35a8ec2d3ed714c90f7daa43feb6875f4ce2e4280f5ce19569d895 The package name tailwindcss-forms-styles mimics the legitimate @tailwindcss/forms plugin, and its src/index.js copies that plugin's code verbatim as...

Malicious code in tiny-focusgroup-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c6d210f6c61d0ec49fac4bf487a2d71966b1f3dd59653d8a8fdf12e04f9b306 [email protected] declares itself as a focus-group accessibility helper, but thunderboltRegistry.js runs an IIFE at require time that...

Malicious code in wcag-color-a11y-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b6e72298f32298d6558f5d52eb7a9d5185b37fe8df14748bf61d6686dde1cb3 Package is advertised as a WCAG color accessibility helper library but ships thunderboltRegistry.js, an IIFE that on module load executes shell...

Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

Malicious code in @bellaxchuu/crystalred (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @xatancchii/velycxbail (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in saturn-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in shadowmd (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @babell/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae256b9ff55b98040ea9cb6561edfe1c4e2db94bd111fb19a449651bd6b5d44b The package's package.json defines a preinstall lifecycle script that runs curl -L...

Malicious code in @nagular/router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db05365620b3f716b28b41577e593bc35a6699aee20090951158c206c2585ca package.json declares a preinstall lifecycle hook that runs curl -L...

Malicious code in @nagular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ac4933487fc7ccf7161933c9d5f6965b5e1f0a3efeaf8ea5349096835008557 The package's package.json declares a preinstall lifecycle script that runs curl -L...

Malicious code in @kibt/www-nuxt-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of...

Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

Malicious code in @angularr/router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83 The package.json preinstall script runs curl -L...

Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

Malicious code in @angularr/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 801dcd769bdbf58aa11a657a5344e075ed57fcdafd1384b47ba611956e7cb365 The package's npm preinstall lifecycle script runs curl -L...

Malicious code in @angularr/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 122d8c8fdbfe9bd590dd3e1c41a6afcefff4f1c552af5f1756577975c84878a8 Package is published as @angularr/cli double 'r' and copies @angular/cli's description, keywords, homepage, repository URL, README, and version strin...

Malicious code in botmaker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...

Malicious code in chai-as-testmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A...

Malicious code in css-scroll-state-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cffa0affc34bac3fa24fcc7c67aae4d120066f4f856cb8b637bc04c6ca9d482c The package presents itself as a CSS polyfill but ships a payload file thunderboltRegistry.js that executes an IIFE at require time. The IIFE uses...

Malicious code in css-snap-target-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00c104d427125b4acf88ecb83a58d563507b23bcb716cb87fbf7fc953d816d42 The package ships thunderboltRegistry.js, which uses childprocess and process.platform to collect host information and POSTs it via fetch to the...

Malicious code in css-starting-style-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a,...

Malicious code in core-js-gnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937 On install, package.json runs node init.js as a postinstall hook. init.js collects host identifiers os.hostname, os.userInfo.username, os.platform,...

Malicious code in css-reading-flow-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b18e313d5fc67f07c1bcf051bd79a85dca97bb3c4510d9755efca6414bb55ff The package is published as css-reading-flow-polyfill but ships thunderboltRegistry.js, which impersonates internal Wix thunderbolt registry modules...

Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

Malicious code in css-light-dark-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7 The package presents itself as a trivial CSS polyfill index.js exports an empty object but ships thunderboltRegistry.js, which on load runs a...

Malicious code in css-interop-observer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 089bdc1dd6bdf0216bb911888e81ce97dc171bdef2588fd5de0aadb4a64fbb2b On module load, thunderboltRegistry.js executes an IIFE that runs id, whoami, uname, ifconfig/ip addr via childprocess.execSync and reads /etc/hosts,...

Malicious code in css-relative-color-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee0efef48c7d56201a037b237f11ec712853f86e74f6a00ef8011732b31363f1 The package name advertises a CSS utility, but thunderboltRegistry.js runs an IIFE on module load that uses childprocess.execSync to execute whoami,...

Malicious code in css-logical-prop-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ffba65f80ee8f200199c8c90ebb6297b8590537c80ea50bb34874d91665b5f The package ships thunderboltRegistry.js which imports childprocess and invokes execSync with curl commands at multiple sites lines 30, 39, 47, 48. T...

Malicious code in css-field-sizing-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 549bb8820cb6a8a35853826d17b64df14c0561b83790192a33c5dc76dbad53b9 The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shell...

Malicious code in css-env-function-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e6fced50259d6d3781ef3917caba965e4744420188c3e06919541b64e2e294 Package self-describes as a CSS env shim but ships thunderboltRegistry.js, which runs an IIFE at module load that base64-decodes the strings...

Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...