Malicious code in supersignaturenature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1df02839294b29ff278b7a80505be50de75eb0f317f4bf29635236a75e4b15 The published dist/ bundles main/module/browser entrypoints contain code absent from the src/ tree: at library load they read an encrypted rsaToken...

Malicious code in secretkey2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook node lib/core.js that runs a Windows...

Malicious code in js-tokens-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f8ed5536e88f2c77c432b868367e25dea9244052779e825999e6e4324dcc35b index.js runs getToken at module load time. The destination URL is reconstructed from a numeric char-code array via String.fromCharCode to hide it fr...

Malicious code in date-fns-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967 package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to...

Malicious code in eth-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e08c035ca41519f1d57d389027befac80a8ee8405612825b633967db5fb8c1 On require, lib/initializeCaller.js runs a top-level async IIFE that decodes a base64-obfuscated URL to...

Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

Malicious code in js-array-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...

Malicious code in es6-migrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8 The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields hostname, ...

Malicious code in vitest-chalk-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running...

Malicious code in mfacord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8426c0e4e80e0bd9839d8517e060bd923775b8a3e100aab57e18b4f47c970e On require'mfacord', index.js loads lib/cache.js, which on win32 decodes a hardcoded URL...

Malicious code in discord-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb4ed3f4fab9ec795405127517bce22b0aad8277ba7db65a563d311660334760 On require'discord-mfa', index.js loads lib/cache.js which, when running on Windows, downloads a JavaScript payload from...

Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

Malicious code in mfakit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f11dc9d39df6906a4b784b0cb3a584b5307816d20c4cc04fb28bbb40f59c3fb8 The package advertises itself as a lightweight Discord MFA library, but require of its main entry loads lib/cache.js which schedules a setImmediate...

Malicious code in 2fasecretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...

Malicious code in 2fa-secretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8458c66987512aafeb111d45ec4c5639bc5bb43cd342777b9972e727719fe2b7 The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdio-ignored child of the node...

Malicious code in sentrykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7070cc1752fa75b405bdd0617a934d29519df28fdd0d069c0d4b5f7adaf44f55 package.json declares a self-referential dependency where the key sentrykit maps to the bare HTTPS URL https://repo.securityctrl.com/sentrykit instea...

Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

Malicious code in confluence-create-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011485304eea045bddd134da5fdabfcf9d96acd0f2c78e1800a4c32674a5788c package.json declares a dependency whose key equals the package's own name confluence-create-content and whose value is a bare HTTPS URL,...

Malicious code in confluence-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7615f50c489336db7800ea3b79ef26a4e5af311f0484ee31871000e329c2813 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/confluence-editor rather than a semver range publish...

Malicious code in confluence-rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d314e75faa527b1c10dbc34b2867180fb0726f2547d9b0edd0564aec3e38fd8 package.json declares a self-referential dependency whose key equals the package's own name confluence-rest and whose value is the bare HTTPS URL...

Malicious code in prm-bundles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e252184c7a4f29eafe72c86873c662342486b68fe5c1ce3a5405845aa8695a33 package.json line 11 declares a dependency whose key equals the package's own name prm-bundles and whose value is a bare HTTPS URL...

Malicious code in ir-annuities-client-authentication-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d813fc9c0831847a602c97803b7e53603edfb6acef4386e4cde2927c2a7a297 package.json declares a dependency whose key equals the package's own name ir-annuities-client-authentication-module and whose value is a plain HTTPS...

Malicious code in paper-password-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a97853ce25938b0cc295a798fa8c9ae8ab513126e70b93084785636a91bc7ec4 package.json declares a dependency whose key equals the package's own name paper-password-input and whose value is a bare HTTPS URL,...

Malicious code in aura-instrumentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14004b53bc245039cad1473ab4a95c2b2c8fcff2acc4b5f2c0f868da63e103bd package.json declares a self-named dependency 'aura-instrumentation' whose source is the bare URL https://repo.securityctrl.com/aura-instrumentation...

Malicious code in loading-performance-instrumentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dab9307010475c57195f838ba7d7299fe4a753b92926536aa8376f8d096150 package.json line 11 declares a dependency whose source is a bare URL rather than a registry version range: "loading-performance-instrumentation":...

Malicious code in axis-datagrid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b8e97884917400dda89c79754629edd51961e893d64fa580de04bb82bd0cab3 package.json declares a dependency whose key equals the package's own name axis-datagrid and whose source is the bare HTTPS URL...

Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

Malicious code in bui-react-10themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a333445d0f8345bc824161bcc7f6487a59ba9f1f7a852da2643eb7c27dd849b package.json declares a dependency whose key equals this package's own name bui-react-10themes and whose value is a bare HTTPS URL...

Malicious code in mkt-ui-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec25e8ea6f31c47fb8d4f491a39477d5fde2b00f41c3c1b19960931a34f990e6 package.json declares a dependency whose key "mkt-ui-library" equals the package's own name and whose value is a bare HTTPS URL,...

Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

Malicious code in librastandardlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 519c28eb8d9df0a16d93e1b1c486f1ad4a9092a9bf958aed56f273cfe1fcfc14 package.json at line 11 declares a dependency whose key equals the package's own name librastandardlib and whose value is an off-registry HTTPS URL...

Malicious code in vui-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0411fd70c7f76d71355fcd1ab650dac43afefc55b802d86ad4755b06456bb1ad package.json declares a dependency whose key equals this package's own name vui-gateway and whose source is an off-registry HTTPS URL,...

Malicious code in jira-projects-backbone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75bb5293b51dc977d699982756ea69987397ce86f50d12753844198bf40294c package.json line 11 declares a dependency whose key equals the package's own name jira-projects-backbone with a value that is a bare HTTPS URL,...

Malicious code in data-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa1f0fee2d6635331e603f520ba2954b11ac9e85bbd5b66f27c18be5940c3041 package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL...

Malicious code in oit-lib-oracle-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63a2d32099a0c4246e0b8711f8b29d321b7d1c3a0a99e36edc367934fc9f34f3 package.json declares a dependency whose key oit-lib-oracle-util matches this package's own name and whose value is a bare HTTPS URL —...

Malicious code in gridster-coords (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245882b881fde3396fcb6e1e14f8b0014fc64cd1d02d27f101c8fd2a0b16c944 package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridster-coords instead of a...

Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

Malicious code in qbo-ui-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7391c0f366c6339b3c6c75a1e891d1123cc4483ba3c01eedc20ebbbe3dfc48a7 package.json line 11 declares a self-referential dependency whose source is a bare HTTP URL rather than a registry version range: "qbo-ui-services":...

Malicious code in framework-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...

Malicious code in ring-device-settings-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3ea2aed3d7e8c0b9c99532d6714c486a5ad685418ebbd96c67b44b63f79fe01 package.json declares a dependency whose key equals the package's own name ring-device-settings-library and whose value is a raw HTTPS URL pointing a...

Malicious code in katal-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ff7c110d8766d130db16799f1875e420bdaba20866624b593a209ace7a49d6a package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/katal-logger instead of a registry version range. On...

Malicious code in payments-ui-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b49e2f4d16837b49ca7d82e2c5a46c2a861c3f2c3d63596c730749dfec0337 package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a...

Malicious code in calcite-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91223994e8bb4e46e1b3ca5eea1714a25fedbb828090590110f8c23353c6ec17 package.json at line 11 declares the package's own name as a dependency whose source is the bare URL https://repo.securityctrl.com/calcite-web instea...

Malicious code in tabbables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb package.json at line 11 declares a dependency whose key equals the package's own name tabbables and whose value is the raw HTTPS URL...

Malicious code in jsb-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368bba2e9d134a0d1ce565627644361ebe98bbf7bc2fd04812ff7137c300eaac package.json declares a dependency whose key jsb-adapter equals this package's own name and whose value is the bare HTTPS URL...

Malicious code in alimama-minisite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efd48d631afe828271bb266e4ddb8f2f6d0a8305294f56bde57d614c1cbfef package.json declares a self-named dependency alimama-minisite whose value is the off-registry URL https://repo.securityctrl.com/alimama-minisite...

Malicious code in one-intuit-help-system-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c22e9eaa97b1ee548e6ca6ac6257ea72fed0ee92d5b54255781e62b8ae19783 package.json declares a dependency whose key equals the package's own name one-intuit-help-system-utils and whose value is a bare HTTPS URL...

Malicious code in npm-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a6c4f2b94932e8bcb68c0a146d536b7e3a00d48041aa5a6fc9edf9f82ae5244 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/npm-extension rather than a registry version range. ...

Malicious code in mintel-taskbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL...