Malicious code in cacao1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8 The package has no advertised functionality empty description, self-referential dependency on its own name at ^9.9.9. Its package.json declares both...

Malicious code in yamlformat-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in yamlformatter-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef2cbf7d7c360d11860ea9383a1ed84b491e75361f994359fd97284a5d25cdc2 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

Malicious code in @fleetbo/svro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d86373813cd4d2b65edb11f6a3f352ad81a55e7de0444884f66b0adb482e661 The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled identifiers 0x56260b, 0x12d64...

Malicious code in @znan/wabot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e857d5e68584a6a0b5bde34073d45d16540ddda6d38bf7b3082e49d07bd8b484 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

Malicious code in @hd-team/app-dnpkg-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529 The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a...

Malicious code in @hd-team/app-impkg-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4a6c7bf61aa8ff219249cee5204bc5fe556e216c34afa39a5ce2685399ffbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a881d064bac4343f3b849e3b2e45fa0bb9fb8249f191f85297f53edecf08d96b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8d3c5fba8b00e8f8ebe7868093ff8cbe2b14607b15abad8a711310868d0833e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-impkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1337f5939f8a1aab2f4e110aa41afd3b9f6cfe4501319a0ad33de48abf178cc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-ten (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39fc060cffde63f6797eaa1eb715dbfec4a108f1c8d4b54d6ed6b63072bd9d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30c16d5b694328dc82c0f6456769dae351790990437b7411f9e3a868ebf48dac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-eight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ebbb10d70e38e5772506ebd2604502a39d4c462730a4a1f2c4f21147959af9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flyteplugins-redis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-nsight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-agento11y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-echo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in hydration-ui-dlx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e76afa004355ba53a89056c6daff511bb4f41e2bd666e2a5592d033e079e5740 The package's main module contains a top-level IIFE that chmods 0o755 and detached-spawns dist/internal/math-calc.mjs, which is a Linux x8664 ELF...

Malicious code in svelte-ui-dlx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3de011fe8fbe406c62d909048d60d2619dbf85d8f8ec05079c8104d966e52a63 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tailwindcss-3d-animate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc554005eb9004f33d22597b929261d865d4bfe991d0b99d148dc25fffb7e97c index.js re-exports the legitimate tailwindcss-3d plugin and then appends evalatob"..." at module top level, so the payload runs on any...

Malicious code in tailwindcss-form-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bf4e5fbd59048a5ab6a5c04ad7c98e7246c9cf57363d95acc84f92d8ca883f4 src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style 0x string-array cipher that...

Malicious code in stackpaths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a27ce2899b65f55deaab5feaf1b3cfd2ae674a45fd3e87ab442c58d3d89ba79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in inspectstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17cc87250d7ea2211f538d56ca04d81a6653e6493beb475ea371873ddfe6a65e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in deepjoin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7191d8ad9de3616fcf3be682d6755dc092dd05df7bf8c273d1ad867a0edd6d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in charclass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8706b70b3238d5f94848a858e119e3e41d7102032d82a00ff3ae25915311d4e6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

Malicious code in veloq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0f85e80ad1893e8546161034450eaac2165d5eb7299710f0870bc26b05b2 [email protected] is a near-verbatim fork of gulplog rebranded by 'Blockvora Team', with two injected lines inside getLogger in index.js: a call to...

Malicious code in sigcheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6acb99271ede5807243bea2648af5e71511853e99c473309de457a8828ac0ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in morglog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70fd694cbd6fff160cc788117eac2e85e921870f0a2a2e24dbaf81418ed19a1 [email protected] is published under a name resembling the popular morgan HTTP logger and reuses morgan's description. The tarball ships only LICENSE,...

Malicious code in decoris (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1ce74b34855100b6ba312f767a982fb288a802da613fec375aec92665f4d9973 The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in sap-quarterly-report (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2235bdf8263c08fede094c665d2fbc4e023a0f0c5e99631d70ae0685567b37ec During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in ekx-report-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78 On import, the package runs a setup routine that reads a session credential from /tmp/.sandboxtoken and issues an authenticated GET to...

Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

Malicious code in imo-allowlist-xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f429a987c3b4800204131b27faae0c29e55a0761a1fa2a0306ab14a343afd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in mathkitlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c91a8962fd66464487bcdb5e2c217990cfdea55df22e7166c11703f91dfb7845 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bnotify-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0861227aa2c7246f74708656f530b7f99a71f6e6e0be93a1ea7dc3b2d6c814d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dumb-binding-gyp-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c522e725eb8c0c66cf1c713d966b16c91947d48c6fbe50af8782537f944b6da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in the_tax_free_cashier_is_at_9f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0596e225c3ec8b9dfbd5c47b4c4c02d5f5f15c1aff917e7ab480c21936184164 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tset_racie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871 [email protected] ships a single 45KB obfuscator.io-style payload as its main entry index.js. The file consists of a 551-entry RC4-encrypted string...

Malicious code in shai_hulululud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f613531d1e90bc815213b8b20e3f1d9c8889cb7429fe986306747a3b7da99f49 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in grandfather_of_the_desert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 225060668f93f07494e2698abf079d6214336445f644fe5f3b54e3e758b45927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in pybitjs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5 The package's setuptools cmdclasses BuildPy, Develop invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing impor...

Malicious code in trongridet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d37e79174370b2dcd44b05ddb583e65d2e0b878033aa0702653294dc965a3483 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in self-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced9167241d391937ba7b1f2625aa3f8184d832ebc61c182936100ae3a3f13bd Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, once the PEM headers are...

Malicious code in self-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b684f78f17626dead6b3d11131179a7a1aff7fa5e903daeecdac17ce8e3b99b3 The exported generate function in [email protected] accepts an undocumented third defaults parameter. When passed a string, the code strips PEM...

Malicious code in svelte-vli-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e69d1c24676b4273c3413856b424256c6ff7a437a48e7037156fa5f7f8911060 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...