Malicious code in node-fsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a0392a3ddea9b6099e8501fdb827f586a410323cecea214aa50fc1be42183b The package tarball ships archive-sender.js, which archives the host path /root/.codex, splits the tar into 200MB chunks, reconstructs an npm registr...

Malicious code in test_adminet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1971734ce6221624b53d3647a5881c1fe0bc7f8ae4d383a5ff2a9f5080da57c The package's package.json declares a preinstall hook that runs index.js. On npm install, index.js uses childprocess.exec to curl-POST installer...

Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...

Malicious code in filewisee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758d74e75086465a01c3837210bf5bafe22d86e6f087be963e39ccd62ed0b034 The package presents itself as a date-formatting utility and re-exports plausible date APIs format, formatISO, formatDate, formatTime from...

Malicious code in bubblestring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d88c674968228c1d12eff609caca870ebe6d572631e15e2bdde0d0d4b7a320f9 package.json declares a postinstall hook that runs the package's only code file, index.js, on every npm install. index.js is heavily obfuscated...

Malicious code in ddok-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0326cd953f229feb020dd3c1cd882246b6bac2cb0be8ffe9e47d063d9f59c9c6 ddok-modal presents itself as a reusable React wallet-connection modal supporting MetaMask, Phantom, Rabby, TronLink, Bitget, Coinbase, and Solflare,...

Malicious code in n8n-nodes-rce-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c735b8bb20a784446d7a0a4c49369ca3f2696bfe2e8a004799c763fc0a064aca On require by n8n module-load, top-level code in dist/RceNode.node.js, the package runs a shell command via execSync'/bin/sh',.... The command is tak...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

Malicious code in eslint-angular-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a6248527167bc121cdf2c1a874adbc9d433dbe4be2aed160e8abb3eb2ca63b package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:8080/ at npm install time,...

Malicious code in express-bunker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68139b9a62e1d546de6ce2e46d5203782dbf54f1af2edbd2b8f509528eb0f000 [email protected] ships a postinstall script that performs an HTTP GET to a hardcoded bare IP over plain HTTP...

Malicious code in @quukk/opencode-clawmessenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e48f1438950e47277df7d6b0df77f7e2ecf2315323b0012a293299bbb91b9c The package is a remote-controlled bridge: after the user runs opencode-clawmessenger setup and binds via QR code, the installed wrapper authenticate...

Malicious code in @quickcall/krew (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cef7755bfdd2bf753ace888115fd963d8c44147bcf715a0e276f4c6d36208770 The quickcall CLI unconditionally starts a telemetry sync daemon at startup dist/main.js invokes startSyncDaemon and registers a session-end hook plu...

Malicious code in eth-lib-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13895e2e8ee4aa9683c2fd6f0f873a38b19bbc5af207233e22c51668bc7dba41 Package [email protected] impersonates @ethereumjs/util / ethereumjs-util README, author list, repository URL, and source tree copied from the...

Malicious code in insomnia-plugin-poc-m4gester-run (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e package.json declares a postinstall lifecycle hook that runs calc.exe on the installer's machine during npm install. The main entry point exports onl...

Malicious code in assertcoreutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e53b085bfe045b4aeabe9ad77e1066ab0883f27304197377681191c3118b780 assertcoreutils impersonates the popular chai assertion library: the README, the chai keyword, the lib/chai/ directory layout, and lib/chai.js are...

Malicious code in font-huge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a529537a0875d6ab8e2c942ace1db227c7131ff06b7eb4e86b12cd4193da4879 font-huge advertises itself as a font/icon collection, but its exported getPlugin function fetches https://svganchordev.net/icons/107 and passes the...

Malicious code in @sqlite-panel/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb20d0c9e601940f84c676cd74d174e06a740b6bcb90c12d38cdcecc6ca68696 The package's main entry point index.js fetches a hardcoded GitHub Gist owned by 'getchainverse' via api.github.com and passes the returned file...

Malicious code in permcarmserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...

Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

Malicious code in @omniwatch-wick/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77b823fd6a050959af05f24e75f87cad447ab83a65c31349c7a559502af278c index.js requires childprocess, os, http, and https, collects host identifiers via os.userInfo, hostname, and process.platform, and POSTs the collect...

Malicious code in @outsmartly/metaobjects (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede306bb744e7248af8ac267412edc6cb95f6720dc3fd6f6766b7c3ce915853 On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify API URL built from the caller...

Malicious code in polymarket-stake-kelly-math-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a7da439d70295bc7192ecc100ebdff0b08a601d31aa98dcf20af783ec169a26 The package declares a postinstall hook node scripts/install-check.cjs that reads a remote JSON config from...

Malicious code in react-icons-svgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ccdc7a601182ae60a4f75d72cb54aef12fbe94cb209625f6f1c9be47b12096 index.js stores base64-encoded literals svgValidateKey, svgValidatePattern that decode to the shell command npm install rollup-plugin-polyfill-handle...

Malicious code in browser-use-headless (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a85306ba70b361b2851e9e3db9219235556e964e62ad131a7c9760ff63b49b88 The package presents itself as a headless browser-automation helper typosquat of browser-use but contains an appended credential-stealer block. On...

Malicious code in node-fsmetrics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b67fad1d72f63941a3973df07e6cbd980c9e3c3bbe5041818f58b9be07d6b7e9 The tarball contains archive-sender.js, which tars the directory /root/.codex, splits the archive into 200MB chunks, and uploads each chunk by runnin...

Malicious code in route-processor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 430b2eaa9fcc780c6e6a20639c32767b24ca2d47ba708c056c68bc78fb03e425 The package's default export builds a URL from split constants protocol/separator/domain/path/token resolving to https://svganchordev.net/icons/107,...

Malicious code in node-fsmetrics-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9958558a30dea32a3b0fc2e48bb775433e1f12b339030a8d21872ad058bc28ff On require, index.js hex-decodes the URL http://152.53.120.90/cmd and starts a background loop that polls /cmd/commands, executes returned strings vi...

Malicious code in @sectest429/hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d The package advertises a single function module.exports = function helloname but ships a preinstall.js lifecycle script that runs automatically on np...

Malicious code in @torbeck/priority-queue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3109ebd719fa91812bd69e50b418b78f2a04c5478924f6ff53054cb798dc937 The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info, the original author 'Eyas...

Malicious code in claude-team-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e9f6179a67a2904c37bd9cff22174a8c57755972fc878047993c35c03f5544 On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with the real terminal attached...

Malicious code in @dervix/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118dd8f5224b1dcccddf25d74c6c9fe3543b444173ea293dafa28154e82689d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @dervix/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c299d96dca6144eec3e8be8770c98430139e9b6b982762da448ef50b7bde06a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @gleamkit/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008464ca4d7ba15b4b8c6d3a979586c61bd527aef3a209571d28c0ba912403ae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @gleamkit/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6a306142d74b2781d66322adf2bc1b9898bfdb8e1814d2cb511c3e49b75c13 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in loading-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94 Package name impersonates the pino logger exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js, lib/redaction.js,...

Malicious code in @uw010010/vite-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280687ad50e03b43bf7f26df6afb1a8fb794eb486c126b2368f37c6b76625318 The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author 'Evan You', description...

Malicious code in @sheltr_/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ecc4dcd6d76f100601f8b37a6b9c3aab899770ab361f2714f9193a2f8d0db78 When the package's bin entry is run, it spawns an interactive PTY shell using $SHELL with the user's full process environment and HOME as the working...

Malicious code in @origindev/ethaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21a07b9029fb9a0c16ec0d934edab2123c43d1999489d510c3bbabc5a0f1d5e7 @origindev/[email protected] ships a single heavily obfuscated index.js wrapped in an RC4 string-array decoder with IIFE rotation and a self-defending...

Malicious code in @spzhongwin/skill-logger-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970980f38a6389d5b622ca41ba3b418f1538b2a38f595536c97acb934012b8b9 The package advertises itself as a skill usage/error logger but, when activated via the openclaw gatewaystart hook, opens a persistent WebSocket to a...

Malicious code in nodemon-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8b1d5b3dd215c6c8d726b73ad11fbb29e7285da9a7e88854552931f750d437 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

Malicious code in cktool-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ee2228fd4f97fcc261019bf662b6e3006a5aed7a6f3bc0ec4fa505a84aa037 cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolver misroutes the scoped nam...

Malicious code in polymarket-math-stake-kelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to...

Malicious code in gptlite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1b12c4a304855689342c2732abcf11dec5cc206960f495525b967fca6d14662 The package's npm preinstall lifecycle script preinstall.js, referenced from package.json's "preinstall": "node preinstall.js" invokes...

Malicious code in polymarket-stake-kelly-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01715ebd11c8adf6ac26ce11bc5fc07e6cfb6775fa77dbe1ca022d0d6593b99c [email protected] ships a postinstall script scripts/install-check.cjs referenced by package.json's postinstall hook that on every np...

Malicious code in compliancepolicyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9f18c11413e208ef48e083af8a065b36134c2b37b5fd1474a5701a986a659d8 [email protected] registers index.js as both scripts.install and main. On npm install and on require, index.js loads lib/core.js, which rea...

Malicious code in connectedmerchantsserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 834b886e34ea551223e9eeb30561267c93226eac960729a9a0ff6a06277c74cf The package's scripts.install lifecycle hook runs node index.js, which loads lib/core.js. That module collects the installer's OS username, hostname,...

Malicious code in datavaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf831f155eb2a6d04427e5cc3cd239055844e80c3b02576a5d546e4e7ab42b6 On require of the package's main entry auth.js - lib/writer.js, the module attempts require'auth-gen-next'; on failure it invokes execSync'npm instal...

Malicious code in node-path-addon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dbc52a88818bccd5602eb556ea4bf089dac66c44a2bb1ecbd6fddd6723e9d1d node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry path.js delegates by executing...

Malicious code in node-procmetrics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ea7e26b73fb4fa21cdd545045f2a360a02d1013efe25cd6ab7aedb1fec72c9b [email protected] ships archive-sender.js which, at install/execution, tars the installer's root filesystem excluding /proc, /sys, /dev,...