Malicious code in riot-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b944a9e85b91a70a2c0f84390f4537b2b1babed308cb23c165bf61bc20a91769 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vinzzsync-wacli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6515588ac57ec4218f28d221b4c94d785d9455f03c0c6ae27b97fc66fdd6db5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tanksync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45dcd24fc5596e9273938687d6878a8927fcdf9ffd63982034556e84c3339065 The package's advertised API downloads a JavaScript file over HTTPS and executes it via spawn'node', payloadPath, detached: true.unref, leaving the...

Malicious code in @consts/links (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddcbc6f472b5dba063f65d700ffb3669e4b33c439ec16445d623240b028202a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @digi-kernel/digi-kernel-constrains (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cf968a9064d02510a559a3850f8fbbda22f6fc038605569e6f6939a139aa115 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bb1ptest23/test-paket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88718be23e6bf753453adc1110580e87b675e7881b945d419746afe4bebcfa5e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ossf-package-analysis...

Malicious code in scrapetools2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233 scrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways eu.orbitor.dev, dget.top,...

Malicious code in aseity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e setup.py invokes aseity.compat.ensurecompat, which base64+zlib-decodes the DATA constant shipped in aseity/shimdata.py and passes the resulting Pytho...

Malicious code in caracas4check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...

Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

Malicious code in metrics-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60ce93696722d633e9eea7b3fac6f76ebe61a581bd2d1d79efb778f8cb015399 metricssdk 999.0.0 is a dependency-confusion beacon. setup.py runs on pip install and metricssdk/init.py runs on import metricssdk; both hex-encode t...

Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...

Malicious code in donutautosellsrc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb setup.py invokes a module-level trigger that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run, which...

Malicious code in requests-cache-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1655ea47fc7ccd39294203776ee3dcb01a394c40d93e05b7b527700b19de42c8 During installation and importing the module, the code downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in chai-as-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line 4.4MB obfuscator.io-packed IIFE hex-escaped...

Malicious code in cma-self-hosted-sandbox-cf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d91a7568b717361d5b3727d46e8bf567fc038f95c5fa22c5222a272460bb9f35 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the machine's hostname, current user info, home director...

Malicious code in sherpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf The sherpy package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at...

Malicious code in @digift/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 103ec4b63e45d1bc9b3e3c2e616eedfa134f9f8bdcb6480f33fbbaa280038803 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nubjs/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b292cfe4598353bc8491677099fd2c056f4136eb686345bbdbe68fa887e368c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zeronexcode/baileys (npm)

makeWASocket in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...

Malicious code in shoplist-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6 [email protected] is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook preinstall, install, postinstall...

Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

Malicious code in app-sca-info-banking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...

Malicious code in reqparser (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b829053417a14305f80204983289f120f71abd2472785cd4e2adfe095599003 The package name 'reqparser' resembles common HTTP client / parsing library names in the Python ecosystem, a shape frequently used by typosquat lures...

Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

Malicious code in n8n-nodes-moonlet-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec Package presents itself as n8n helper nodes but ships an empty stub index.js module.exports = and no functional node modules. On npm install,...

Malicious code in n8n-nodes-moonlet-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f49ee5bcbcb7e8f1028de4021134fdbbc895e737700cf82a834fb26d3b23dd05 postinstall.js fetches an opaque binary from https://mkicom.com/.well-known/pki-validation/ctdn8, writes it to /tmp/.nc, chmods it 0755, and launches...

Malicious code in n8n-nodes-flowstats (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aa25eb3d56eb14b75cbb4dedbd5d09063e4b742b53acef9a4096cc77213b8f3 The package presents itself as an n8n community node that annotates items with flow statistics, but nodes/FlowStats.node.js contains two independent...

Malicious code in wallet-connect-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d The package's postinstall hook runs node./loader.js, which base64-decodes an 8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and...

Malicious code in agency-testts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that auto-runs on npm install on Windows. The bundled 4444.vbs is a 674KB...

Malicious code in secure-env3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb86188f9853b34c6dc3cf9c8259a789920326e8ddf4ae4cd3566385bba3ea1 The package presents itself as a dotenv-style environment loader but ships a Windows dropper that fires automatically on module load and on CLI...

Malicious code in agency-test-exercise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...

Malicious code in better-dotenv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf The package is a dotenv typosquat that runs a hidden Windows loader on every require and on CLI startup. dist/index.cjs and dist/cli.cjs invoke...

Malicious code in chromatitle-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with...

Malicious code in chromatitle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793cf7eb2b4de9c41e229fc89c393e38f05141991762f69f310e1397fa464f9c chromatitle advertises itself as an ANSI color/title formatting library but its main entry src/index.js unconditionally calls bootstrap at top level,...

Malicious code in my-private-pkg (PyPI)

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches myprivatepkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POS...

Malicious code in vercel-runtime-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f59b48451cf996ea42b291d60ed56205aeb9803222d156f7880fd6b92032b1c6 The package presents itself as a Vercel Python runtime helper but ships no runtime functionality. Its only substantive code path is a public function...

Malicious code in prosocks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2bf0fd5f445eed9825601f2b4497502054176d106d4fecb9eabf38312dd582 prosocks 1.0.25 enrolls the installer's host as a remote-controlled SOCKS5 exit node under a hardcoded control plane at https://kalnetz.store...

Malicious code in analytics-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b78f3ed716380da74c5d54de6e24b6b128536a7ce5772e8b05d03108a1d9b74 The package is published as 'analytics-widget' with an empty description, but its main module contains no analytics functionality. On load, index.js...

Malicious code in building-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4618f06d0398ff90ef90003464e79f23609a160f4d1606f60cf797fb73fa6dcb The package's sole content is index.js, which on load schedules a timer that fetches a hardcoded list of privileged same-origin paths /admin,...

Malicious code in cache-swipper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50cb98e5f107fe5bd1cd9434505219880014742674def9c64a8ce8552e04a626 cache-swipper advertises itself as a safe cache and build-artifact cleanup utility, but the exported runOperation function performs an unbounded...

Malicious code in c2-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5e21fe48a0a1a03a1846e11cb06360950603c3bd8ccba5979c431c84779ba0 The package name is 'c2-client' and package.json declares a postinstall hook that executes 'node setup.js' automatically on npm install. The setup...

Malicious code in simple-date-formatter-new-16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e57e9eff2fae987a2a23e3107d64c818e020b03380e31d6a3ae9cf8d4eb14ec package.json declares a postinstall lifecycle script that pipes a string-reversed shell one-liner through rev | bash, decoding to a bash reverse shel...

Malicious code in eslint-config-compact-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc01e3a8316b2d4e11b34a9c8cbe1cf5bd2af83a6a70052e40a22b54f13f78b index.js executes on module load and collects host reconnaissance data — os.platform, os.hostname, os.userInfo.username, architecture, Node version,...

Malicious code in simple-date-formatter-new-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe2adf4e9d3b54b33c0e80285a5b0eb4d81dfde75c7a5b7a202ac43793268cd The package presents itself as a date-formatting utility index.js is a 160-byte formatDate stub but the published tarball contains an SSH-key...

Malicious code in simple-date-formatter-new-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54 [email protected] presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstal...

Malicious code in aliftech-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61479316af4cfc0884dfe88744a0ed14fa64e052471cc216667c80502689860 postinstall.js runs automatically on npm install and reads os.hostname and os.userInfo.username, then issues an https.get to a hardcoded webhook.site...