Malicious code in r4wk-book (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5cbca68751eb879140f7c896a0dc3c324e9f4dbc8a1651b38b246b299ba4eb On npm install, the package's postinstall hook runs node.worker.js, which detaches a background child, waits a jittered delay, and opens a TCP socket...

Malicious code in typedoc-xyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0351fe37644a8a60b6072329167e3b1cbbc8ebac67ec75b453a475e90ac67a15 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tailwind-scrollbar-hider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaa2dba899c9723740dfcc2fe8588bcf695f021442bbe8de1156239029bf7987 dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes evalatob'' at module top level, so the payload runs on any...

Malicious code in voice-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4e872ad9052cdd5d86c4c1656c57e5a899513853824efc24d4636a3c1679e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in video-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdb2c9b6369a68d75f6e0df274da90f2685d5735f944992516f13c3e9f60b0b9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in text-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163de9a9fb651da86f266476767aea6f3b53b316ad3a3b269d469e6447fe43bd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-streak-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b054f1d8e8f496e3bdabacf1bf5042b2aba5f9587646cbb874ae9e3ec9c7c7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-map-metric (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2880778c6f9a95fb00d5476c859051c8d9645b321b6d84613a3c28fd55ed0bef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-hydration-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f997a8db8add85fb519c98d2171e0a540bd9d4949a9dd0e0445ed98cd59db9ab The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-intake-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 828a6fbcf086b6736c00f10ab9346c3bbd3904ed3505852e2b4d342a379cdd79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-goal-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 599aa19770a72a0fa6e983e317d13b3647eaf8412d4b5b7ff10067be4ed34c82 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-streak-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11ecbb895ab58bd860a0104e8ce0cea32f5d34ff53f118ae8591387f5d6121e5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-streak-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 211b40d9426fc23200004fb66f846a5e31dd27dafb924bd99957954f6f4dd1f6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-insights-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13837ce89a955f11d9e25b59ca9b59b96ffef7d05338f95b42d1fcd062c7b543 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-insight-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b58dbba652e648d3f172a1b9ceffe28679dbae47aaeb8b29eed4ac964556f48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-daily-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47e6392583e46c5137935ed3fb8e29feab51a88b0ddafaf033a27962f8588130 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in spotify-url-infos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72208a0a63e3b9eb2549151c6b0899d84e79df1a1058cd72e048c3a44592440 Package is published under a name resembling the legitimate 'spotify-url-info' but its shipped code is an exfiltration tool. index.js invokes...

Malicious code in chai-as-otc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf771adc4f92ba0d79ea56bdcc1e42db57d1bc7421f0dadb0544f619e16b5ca1 On module load, lib/initializeCaller.js required from index.js runs an IIFE that POSTs the full process.env to a base64-obfuscated endpoint decoding ...

Malicious code in mkb-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27bc086d2159cad3d4eb02427ea2daa5f66ad57c39cbbaad5a8bb367071f4fb7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in hydration-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c60e3a0dd707077bad78ec7f0e5f79032dc9b86814d65bfd0083275a6059de The package advertises itself as a dependency-free streak/date-math library but ships an x8664 Linux ELF at dist/internal/calc.dat and auto-launches...

Malicious code in modules-newline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a package.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to...

Malicious code in react-remove-properties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f package.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties...

Malicious code in python-walletlibr-v (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello that prints 'Hello from my custom...

Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...

Malicious code in secretkey-2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd Package presents itself as a zero-dependency TOTP library but its postinstall hook node lib/core.js and its advertised validateSecret API both trigge...

Malicious code in spotify-url-resolovela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045 On require/import of the package's main index.js, a top-level startBackupLoop call runs immediately and reschedules every 60 minutes. It archives the...

Malicious code in vite-plugin-images-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388 This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the...

Malicious code in vite-plugin-image-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019affd7dfc88e28b20dcce52fe53661a514582fb11c51871126b967399a01d8 The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script into every produced HTML page...

Malicious code in vite-plugin-bug-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127a50da55320d2b9e8e99e06d4cccf3d005cc997f3845bcae0738339cd5b882 The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every built HTML page produced by...

Malicious code in vite-plugin-image-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04 The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its transformIndexHtml hook injects an inline into...

Malicious code in mham-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0dc3c71ee333b190e3e7202f7a222b4fe242fd50974cda9ec122b4200bd5f4f On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../public/logo.ico, decrypts i...

Malicious code in js-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500 On module load, src/api/session-api.js reads../../../../public/logo.ico a path outside the package, DES-decrypts the contents with the hardcoded key...

Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

Malicious code in ecobee-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...

Malicious code in css-import-order (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4 package.json declares the package's own name css-import-order as both a dependency and devDependency pointing at...

Malicious code in cscasereadserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 336250fe38295375704495b6529ed6eb82f7006b6249c78ace08bc92d96d4bde [email protected] executes a preinstall script that auto-runs on npm install. The script collects the installer's OS username, hostname, an...

Malicious code in cat-embed-i18n-res (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c612800e80bb36720e75741be9665ab6acbed58bcd5d51065fcedd1d990aaad0 The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are HTML/JavaScript XSS payloads...

Malicious code in desmoswork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92541d82d133f0d80ad0e7dd4dc1595038f64af50558f26398c0a1c3627928aa The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmosmathwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccdafeec1f447c84fcca9f7f17e41c8e940b8bd65c9caf72b1bddbb2befdea4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in classroomwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475464061a4252e9e926ad06f46e5b9223c8c0fc5b4921df5acfadbb3cacf8d9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in pleasedoyourhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c97c52ac22393718c1c8fd5478b19b5b352b1f8c01de5f2aa39e54c3305eaf1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmoshomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fae975f53feac57fc6aec90279e55e994d6e61d177217b012dfb59c6f42a7e8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in classhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ef17879328ca7cff2fac02018b2155038da8e7faf071aa080d9c3272ba87a3d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in classlesson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5980732c2d869f27728cb78552b2adf259f87f10029674e2e84a4db390377c67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmosistuff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c61a3c57b3649dc23c3534ad9f8b872093353a38ed7995af9cda6d4102bee8b0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in superdupertest111 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dafc169a0c96b769349ac7685ff37d6ad663db50df14862a784173cde38dbe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ilovedesmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efb46da64ab0f3eaee41abecec08214a4af0f228c701fd39ad711c0ae124927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmosisfire (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0679b40ac71c7b8ce0dc0557c8779a85ad10fac03ff678128ec4aa687c5e243 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmosschoolwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9575a8846e102604d72f61d91f37c559e58d0fca4c117008257d096afc2a2acb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...