Malicious code in kotanku (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2281ff1cf735f26084f13f5f3ef5e1d5f9faf8cf06254532e5ee6d27204f52d1 During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d669fdf7584f17d952cec3ed432bdb8f07672b43c3bc42ae68aa2d042d51481b Package appears to abuse PyPI for a CTF-like exercise. It can collect up to all environment variables. The package does not exfiltrate them on its own,...

Malicious code in riakcs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3dada3cec22fb43bb528b8f4f7173bb346b25e373eaeb719af2df48698119240 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52341cc032f6be32e80b36dd9335fb011427f1653819641929fdeae7e33c594e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 303700c14fc5b066dd3821d3427defb3496e20c5eb108dbe68bfb9587bcaa0d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e9bee2f0db39d02e7104c0b3f1a5da858186780f017ca1f79442868e717ebdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed1911fd60834f2910f529893e49c1cfef7d68b4bd3d5f21913cf43eabe337a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in statist-browser-typed-client-eventea.projects.tdevice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bfc356c8dee2a88e368a13a85f1445995af94a63048b78f193f375293e19ef8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbb3887b9c3ca309351d2a82525382a65eecc014f7e5909f4e2d18bd8bd38ab0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in statist-browser-typed-client-eventea.projects.pwainsurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 418843bedc1ae76d77b53fe77e903b5611a065e3add5b057bdbeec19ac46be29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test-noexist-xyz-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6984c0cfd599175b528146e9bddb0ef6ad0ef07a21bc7dd78e6bdb195bd53d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3693c930557492daa60f894ec7c21501081f3230da12c25847912e51da49d1ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e85a74ba93af51a80d66996947352cdb86175d21c8db850c778f2641d56ced1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @coralxyz/anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763 Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor hyphen removed. The npm postinstall hook,...

Malicious code in titan-exchange-shared-permissions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6 [email protected] is a dependency-confusion reconnaissance package. package.json declares a postinstall script node index.js...

Malicious code in modern-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5 On server-side require of modern-localization, the package's main entry runs a top-level async IIFE syncLanguageSystem that performs an HTTP GET...

Malicious code in localization-fixer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701 On require of the package's main entry, a top-level if isServer syncLanguageSystem fetches a JSON payload from...

Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126 scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names 'https', 'fs',...

Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3461050b5714edca455c0fd78e979cd5efbdfeeb375016aeb4fe4523f47682 On require, index.js loads adapter.js which selects a platform-specific payload linux x64/arm64, darwin, win32 and fetches it from...

Malicious code in sme-rko-finance-front-operations-tax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa On require, index.js loads platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in sme-rko-finance-front-payments-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8fcad12c3078bf2134f5e3cafd7ffa0ecf9f2bfec919533881d5c65b738b9fa On require of the package, index.js loads./polyfill.js which assembles a set of C2 hostnames from split string fragments via.join'' — resolving to...

Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05877cb287448f82b3b8a223454971cbd881ff8667e597472c04123697295220 The package is advertised as a finance/payments adapter but on require reaches a staged loader. adapter.js reconstructs destination hostnames from...

Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b5dcef9a8613b9de1b3bbd1137a65cdbf087a9a96543602fb3372d7eca978f On require of this package, index.js loads./loader.js which reconstructs C2 hostnames via array-join string concealment...

Malicious code in sme-rko-finance-front-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac On require of the package, index.js loads shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-stri...

Malicious code in sme-rko-finance-front-operations-other (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c11dc6f375e9ceaee8f1b8e40db07f49c88e7bc47715759b101d3513399047be On require/import, init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames...

Malicious code in sme-rko-finance-front-operations-fee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5 The package's main entry ./lib/telemetry and its vendor.js module execute a binary dropper at require/import time. Hostnames and API identifiers are...

Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under...

Malicious code in sme-rko-finance-front-operations-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4ad5f5c931a19daf4fd3f939fc2ed4f1ef2bb034800563cd2ad687f1fbe2364 On require, index.js loads shim.js which downloads a platform-specific binary from runtime-assembled .workers.dev hostnames with a DNS TXT fallback...

Malicious code in sme-rko-finance-front-operations-widget-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a On require of the package, platform.js and lib/telemetry.js run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one...

Malicious code in sme-rko-finance-front-payments-feed-display-list-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e33cae8840b73256d5d48935bfa7b8490ea7a36d56edeff8adfc4ca19dfea49 On require, index.js loads helpers.js which selects a platform-specific endpoint, downloads a binary from one of three string-concatenation-obfuscate...

Malicious code in sme-rko-finance-front-operations-widget-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1cadf7bdbe8322e1878572d42f769a267d9a2af7a61c0da00f02c1436799824 index.js requires./setup on load, which selects a platform-specific binary path linux/darwin/win32 and fetches an opaque native executable from one o...

Malicious code in sme-rko-finance-front-operations-holding-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6838cce82eaa89f91af46e82f5153f7318dafd0ebccb4bdbb6251114d95ff51 On require of the package, shim.js executes a bootstrap at module top level that fetches a platform-specific native binary from...

Malicious code in sme-rko-finance-front-operations-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85709f3e95d677177f1e55976d46cf4e16582e9cf3c1b310a7e67dd09885a743 On require of the package, index.js loads bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments...

Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are...

Malicious code in sme-rko-finance-front-operations-special-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a7bfbc55631ce8b054b20444bf1e335244c998fcf00d1709f951b1afa4cb242 On require of the package, index.js loads support.js which downloads a platform-specific binary from string-concatenated cloudflare workers.dev...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c551dcbca891aad241e275845a629ffe436abba6b8efdde650d6c117108d45 On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from Cloudflare Workers subdomains assembled...

Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...

Malicious code in sme-rko-finance-front-operations-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js...

Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...

Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b21f700cd5e3a5eb33a34fa9e3a9754e73e5794ee1cc57ada01344004a8c921 index.js unconditionally loads runtime.js on require. runtime.js detects the host OS and architecture, then downloads an opaque platform-matched bina...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637 On require, index.js loads bridge.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads bytes from a rotatin...

Malicious code in sme-rko-finance-front-operations-income (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...

Malicious code in sme-rko-finance-front-operations-feed-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee413dd5d9f35d90594093501e52606a50dba9fcc61e73a7de489444b420229 On require, adapter.js and lib/telemetry.js assemble Cloudflare Workers hostnames from string-split arrays oob-worker.cf101-adf.workers.dev,...

Malicious code in sme-rko-finance-front-operations-penalty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887 On require of the package, runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...

Malicious code in sme-rko-finance-front-operations-feed-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc index.js unconditionally requires./runtime on package load. runtime.js selects a platform-specific endpoint, downloads a binary over HTTPS from one o...

Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...