Malicious code in luoxy-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in hridoy-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 221c8e51e1341e954c4f2ea3ea4a139606138c8ecc1ab99e17f403e304f05157 hridoy-ultimate 8.0.0 is an unofficial Facebook chat client that contains two installer-harming behaviors. First, the password-based login path in...

Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

Malicious code in @coopeuch/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 042f083be94ae23751c73b5a73c0f11e4e9ecafd9ee9f1caa8c05b367ac71de8 The package declares a postinstall script postinstall.js that runs automatically on npm install and collects a broad set of installer-side identifier...

Malicious code in @s4yhiitestpoc/scan-https-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea On npm install, postinstall.js collects installer host identity — os.hostname, os.userInfo.username, home directory, cwd, non-internal network...

Malicious code in @coopeuch/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59 @coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version 1.999.999...

Malicious code in @s4yhiitestpoc/r2-https (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6042f718b39be380eeda7c31dc46b056e753cb8a39e51897c8106e49b44f4d0 On npm install, the package's declared postinstall script postinstall.js collects installer host fingerprint data — hostname, username, home director...

Malicious code in @s4yhiitestpoc/r3-https (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2638f8970897121676d5dc3ed7c002ab9d9ccc3e400283e165297a95e3c1423 On npm install, postinstall.js automatically collects host identity hostname, username, uid/gid, homedir, platform, release, enumerates network...

Malicious code in react-paginate-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an...

Malicious code in liferay-workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...

Malicious code in ksp-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b14a9fbd9fc1a48dc3ac0498f9606cecb1a56bad912c7f8a818fad332ef9ad15 [email protected] is a dependency-confusion-shaped npm package whose only payload is an opaque prebuilt Linux x64 native addon loaded at install...

Malicious code in ksp-client-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018 The npm package [email protected] ships a prebuilt native addon at prebuilds/linux-x64/addon.node that is loaded by the package main...

Malicious code in another-very-long-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea9e3cf3d973c07d09048435d4ddc496574ce222d650c228b1400d866ea3ccf [email protected] ships a beacon.cjs that is invoked both from the declared postinstall lifecycle script and from the module's require-tim...

Malicious code in some-very-long-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c08ea2abb307f6ecb9a1896fcc3980e9a1eaf8b29044db67cd985654e1db16 The package is a stub whose main module exports a Proxy that returns a no-op for every property access, providing none of the functionality implied b...

Malicious code in nested-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928 The package declares scripts.postinstall = "node beacon.cjs" and index.js also invokes require'./beacon.cjs'.fire at module load. beacon.cjs POSTs a...

Malicious code in pay-methods-kmf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2 [email protected] is a trivial stub empty index.js, manifest description 'Frontend utilities' that ships a prebuilt Linux x64 native addon ...

Malicious code in cloudflare_module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242 Package [email protected] is a dependency-confusion lure targeting the cloudflare namespace. package.json declares scripts.postinstall: "node...

Malicious code in @coopeuch/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee1a3bb0818d46a9c83659ed32f8ab209477970658d5f6f8241a12c96d137c98 The package's postinstall lifecycle script postinstall.js runs automatically on npm install and harvests installer host identifiers — hostname,...

Malicious code in deposit-limit-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89565d767d3541470834dc9764af6e4abbe4acb5ba4eb721f7e3008e3a80b1d2 [email protected] is published as a 'Deposit limit frontend utilities' library but its main entry index.js exports an empty object and shi...

Malicious code in nitro-cjs-requirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostnam...

Malicious code in @coopeuch/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope...

Malicious code in nitro-bundled-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5 [email protected] ships a stub main module a Proxy that no-ops any property access plus beacon.cjs, which runs both from the postinstall...

Malicious code in sol-mint-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2940bc600ade9f91afdc44ccc04cdab589d276b0504b3f12ffb4a4e827920bd9 The gem ships a native-extension stub extconf.rb that gem install executes automatically, but no C/C++ sources accompany it and lib/solmintutils.rb i...

Malicious code in eth-gas-oracle (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked,...

Malicious code in xrp-ledger-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a...

Malicious code in multichain-rpc (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5765482ebcff5ac393edb3ce06164e7c697a00aa7e32c92b1272dc20184b424 The gem's extconf.rb, executed automatically by gem install as a native-extension build step, base64-decodes a Ruby payload and runs it via eval insi...

Malicious code in staking-apr-fetcher (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405ab5b9651b8e8817ae91290042ec22673c5c99c1b58f45747e47cbb85aeacf The gem declares a native extension whose build script extconf.rb decodes a base64-embedded Ruby payload and executes it via eval during gem install...

Malicious code in web3-signer-kit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe57c8011ef7048ef33ccdb828615b8efd9ab10799a2a730d12c2d854c2e0895 The gem's extconf.rb decodes a base64 literal and eval's it at gem install time inside a double-forked, session-detached child whose stdio is...

Malicious code in nft-metadata-resolver (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee87c382dfd443e81b4cf0e8dc66749f9a129bd4239f984859aaaf760e84c629 The gem ships a native-extension script at ext/nftmetadataresolver/extconf.rb that RubyGems auto-executes during gem install. The script carries a...

Malicious code in tron-trc20-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c840b18eadc331896e56720bc9a00f1239807542202bbd4ff9636737f27d0142 The gem's extconf.rb contains a base64-encoded Ruby payload that is decoded and eval'd inside a detached double-forked child during gem install. The...

Malicious code in perp-funding-rates (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 123418539e0264e9d58c8b51976723aff3eceec10520c231d7bc847edd51d691 The gem's native-extension script ext/perpfundingrates/extconf.rb contains no real build logic: it declares createmakefile'bitcoinrpclitenative' but...

Malicious code in wallet-hd-derive (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install...

Malicious code in mev-sandwich-detect (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d92e0d32c64cdab1627cbfe5bd1d79445d0ff09f4d24336dd9026c02fe46917 mev-sandwich-detect 0.9.1 is a stub gem whose only functional behavior is install-time code execution. The gemspec declares a native extension, but...

Malicious code in crypto-tax-export (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2481974cbcc361b29455129afea878124dafde18097efca0a87235df57f3bea The gem's native-extension build script ext/cryptotaxexport/extconf.rb runs during gem install. Before executing its payload it performs...

Malicious code in evm-tx-decoder (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e478aa0270779720106fc6169e89fde089af352214fc720fbf8c284d51415f59 The gem's native-extension build script ext/extconf.rb decodes a base64-embedded Ruby payload and executes it via eval inside a double-forked, detach...

Malicious code in wallet-balance-scanner (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055 The gem declares a native extension at ext/walletbalancescanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rath...

Malicious code in airdrop-eligibility-check (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb3461788cd7b809ba613c07b39b583fb968ce927ccfc15433673e2731ca68d8 The gem's extconf.rb, executed during gem install, decodes a base64 Ruby payload and eval's it inside a detached double-forked Process.setsid child...

Malicious code in seed-phrase-validator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb8d12a066c24d672bf16efe57267c46c727592ee21beb0e2accb3bb6e4bfb3a The gem declares a native extension but ships no C/C++/Rust source. extconf.rb exists solely to execute at gem install time. It decodes a...

Malicious code in erc20-approve-audit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8 The gem's native extension script, which runs automatically during gem install, base64-decodes a Ruby payload and launches it via a double-forked,...

Malicious code in block-explorer-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cfaa3470065369addbb91e3a6c2072e8add334c4d27bff95f91315aa58ae313 The gem's native-extension build script extconf.rb decodes a base64-encoded Ruby payload and passes it to eval inside a double-forked, detached child...

Malicious code in btc-fee-estimator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1e7bee3158f729d88fdaf6a35ebfd32dcdab26ee9de3d8362d1973774b4b7c The gem's extconf.rb decodes a base64-encoded Ruby payload and evals it inside a detached forked process during gem install. The decoded payload open...

Malicious code in ton-jetton-tools (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e70156c49000f2a02130da13465705bea1e9663b3ba57246a4e264bb12db25 The gem's native-extension build script extconf.rb contains a base64-encoded Ruby payload that is decoded and executed via eval during gem install. T...

Malicious code in hd-wallet-generator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6925082b6aa5db29d0569324b4485976add2368c78635d4be5c52270ee3771 The gem's declared native extension build script ext/hdwalletgenerator/extconf.rb executes a Base64-encoded payload via eval during gem install. The...

Malicious code in gas-refuel-bridge (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd99ebd0f028669dafee3405a3ac4ebb9e264b7d9bfce963e68b259dfe88a3 The gem's native extension build script extconf.rb base64-decodes an embedded Ruby payload and eval's it during gem install. The payload double-forks...

Malicious code in defi-yield-calculator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee8b3e50479b61d2ff6e2f5a19de20473cf8fc3c91f99945aff51f112a617192 The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled...

Malicious code in dex-router-abis (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8f8b62993678b4f720468a05ef91f6fdcc864dd6be78d1ffc6bd14125f18d8f The gem's extconf.rb executed automatically during gem install decodes a base64-encoded Ruby payload and executes it via a double-forked, detached...

Malicious code in react-dropzone-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of...

Malicious code in agent-vx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90f0a2b273b0361ffd4057f114f1be1eaf9469c9746d2737a21947905570ff80 On import agentaix, the package's init.py runs a top-level installmanage side effect that renames a bundled readme.txt into manage.py and launches it...

Malicious code in pafer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a74b7c5b356a87fe0262954cbedbcc432497ab25edaccbade0ce9ce04b16a8c9 In this campaign, the main package webreader has an embeded pickle disguised as a config. A related dependency pafer contains code to load the pickle. During...

Malicious code in webreader (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 165632b7385ab993b6a8aa74c76ff55cc1ef55748c67b5dfabca284bc8ced087 In this campaign, the main package webreader has an embeded pickle disguised as a config. A related dependency pafer contains code to load the pickle. During...