Malicious code in rollup-plugin-polyfill-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...

Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...

Malicious code in @0xlr/question-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f892cd190720c7c8f07109cfcbdd37f66caf5065ba5667b5be0800813dc0cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @0xlr/dep-confusion-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...

Malicious code in walmart-genai-trace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e84b4bbb5660ea5c7f803c4e5d0b12dfe41c9bb147fd2228c72bdda2224291a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...

Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...

Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee541a67169360e2d9ac3da7d19353031dd395c5e1bbe05bb4540ccc4837fa3 The package's exported getPlugin/setPlugin functions, when invoked by a consumer, decode base64-obfuscated string constants svgValidateKey,...

Malicious code in rollup-plugin-polyfill-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26ffb29f08934ff71707ec249cb3572812636676d81be362b826ab0db54b5d1 Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExten issue an HTTP request to ...

Malicious code in reguestsc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20e4ae2ce79408a65e9b4bb348c2d69e20eb6072e3641531e2ec5773f1bbddd6 Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer. -...

Malicious code in @peptide-packets/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0bc181dc4391ee3b974bfa8ec4aafcf982c6bae5f7d9e6850d03d25293cca6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @peptide-packets/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdbac126c4dd058b5bbdeaf3b962acf9e6adce490c77b90545db33b97a878082 index.js in @peptide-packets/js-unimode exposes a listMods function that decodes a base64-encoded URL pointing to a GitHub gist owned by user...

Malicious code in soccketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fc9cac2969243ba864ef1645d5d99ed62e8e4906bc58cd32cee3fad42c9c528 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socketi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f02e02642c533799ed96fac51f973f65097eb5b870dc1a0ea47e2fdcbb70893 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asdsafsafdasdsaasdasda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25b27c7f8bc01a49e1e5d70500418776736b948710b1f4c5bb91b3265957d46d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in passsport1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68604126507bac849b697119200b6ef37f408aaa077f208ae0127605159a9832 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eb88342ad8df3fb45f8f72935ab75fc8c7f90f185467a741928f1c27f653cfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socktio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb2387c455cb19ae4c050c6ae6493e1f77af78385fc684ed7bad4c2452b3ad5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asdsafsadad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67f3884787706e55b04fcf9ab0749dd3f91bd1f8a9d06bd86180483dd9f581cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in passtpor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e427a84573f9d6512d302e4f8ffc7c1011e5b9d337f4b084da29c797ce25b9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mongostose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f6ada9e2243bec8a49064b3433e766f098fd22ec40cbab730e81a5d6354abb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vcse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23149b92d10aaf504452f58832dd63804e33639ceda81871c4188295d3d13117 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in moontose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d8d632d57584e0320f3bc47ad4d13768be553c24a711c602e7c865be17a614 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rlp.git (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 684e2df8545256deec1b035965a2f37977d95033aef05d1ad736577d91a04bed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6432be2aefc6715127bc533a383c361b15420316f144dccfc98f1dd4c7d36f06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fc78fcfb574c958db27a4d94c79bd1ae87c3d5790fdcc044e47f2f97980cfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fsextrra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 317f4ece51d8379de817163700899ce849cc5d750aec0577aa43666cd8a325ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rlp-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc577d1b92381efb525e89481bc661f11dff56bcf0da9180ca63ef67a3d1fd09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers-io-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d93060f754bea6c9c2c5722e253ef9599335702d72a39effe29b2b7668937dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf52df7d6ae5e92551680d7529c4cdf686b19b742648e6ff80253deaa0c9919a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethersss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49d76a2dab802ae6aee4310b7efc5a0862c1964a024e7df701cd99741a033797 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethe.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab166dc6e7cba65e133a48f30493d785512b96592dd9e86b960621ec2125cfcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers.jsonn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acfd52ff30b26f15be66cbf87a098dde096288d776d0be4ecd555ac81e229f81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83a74d7ffe1be2c23f1dc0a21529f6785e63c80990839f2d44aeaa4f514bef37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a69deb9966efa1f01057d9db1ed238faa6dcea2b8c35c6047b306e4f33baa9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rshell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5111add8e3d97e54c2903e39496ddb07c74aa68af8e7f0f1bee761c320dd7ebb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-sequelize-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbaa45eca2fa129cc92d16cd7b391a5af5d33fd35dc07a142359357cbf9cb29c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in host-inspector-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94f6b6fa0236d92aa637686aea23b70cb31900bb701c70d77397fd3da25f2bd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thoughtgear (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e2acc307a077bd79ae28a6f8b7a5448b7947bcaa7496bbbf29804d5a11e5f21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49d4f90386ec40022f0fad868c745b30d446963edadf0e8fe1a3a4a338ce02d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f38e6b7e00f8dcf90ed3683783ed77c81e4eb0a457d33656b14194048625301 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in n158 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3177c7ef8773e8e083ea3062e186487c6ce4f6c0d3919987e2ee4a3df4b1363 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shnc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78b03f61a0a3629c78456a2981b6658bf778cc1d808f5e0b17ea674f425a78bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in inkalabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac5e255b6612d092b73d6781e2ee367bb9448c59c39b8ee492f1afb25db5fd53 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in easyinstaller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c4ea36235cf092d70fea18574aa582526923d2c869fb9f3846aabb0b180c76a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in api-gateway-lambda-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a257fe33bb475cd07d71ded069ceec397276bdd4eecbf78b50d81bde8da769e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...