Malicious code in source-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c2f07bb4a673bf18d866e697b1a943783696d2871fbc5e5987c2117377e798 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in path-match-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7606d3a4e2ac3f49313aee20db3419de70aa76e17ec213031a0c3b6a62110273 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in react-shield (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 407d23edc671619cbd75b7d6ba9aa57d1d7a591669dac19d1c2413a78e586362 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @jacksher/install-exec-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423 package.json declares postinstall: node beacon.js. On every npm install, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to...

Malicious code in node-config-svg-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1 The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtim...

Malicious code in notafollower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768 [email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. T...

Malicious code in datefmt-util-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node...

Malicious code in @khaznatech/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59ac302f60b532a4e864c576593db300a20abba96ae2a53ba5da0cc06d8dc911 The package's preinstall script install-report.js runs automatically on npm install and performs an HTTPS GET to a hardcoded webhook.site capture...

Malicious code in @khaznatech/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d6d321090b3f66b7766ca73a5cebf1a2d3ab2908d8d31f8423616c8094ec0a8 The package declares a preinstall script install-report.js that runs on npm install. It reads os.hostname and the current working directory basename...

Malicious code in @khaznatech/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 820c7f4f32895ef501e6926f624897cf41b5f868bc21c60852cbfc101b4cd5ba The package ships install-report.js as a preinstall lifecycle script that unconditionally runs on npm install. The script reads os.hostname and the...

Malicious code in check-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723c3dbef875102d9d461c655737b930ea9f58f2a5555bd254d954d7003eacf5 [email protected] is an otherwise empty package no author, no description, no meaningful code whose only effect on install is to pull a dependency...

Malicious code in in-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b [email protected] declares its ltidisafe dependency as an HTTPS tarball URL hosted on a Google Cloud Storage bucket...

Malicious code in cspell-esm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e857800f57969e257ed22cd056f2e4a4395de09ac9b69becd0c7c2b931314ab Package name resembles the widely-used 'cspell' library but its main entry index.js exports an empty object and provides no functionality. Its...

Malicious code in napi-raw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d002132bfd19338c8fbc1cc3775c1c8b7be3d059c642881c4dd92be67bf7c895 [email protected] is a near-empty wrapper main exports , no lifecycle scripts whose only effect on install is to declare ltidisafe as a dependency...

Malicious code in eslint-generate-prerelease (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26b3f1a7acd55a1642c9615fe72871781a6c0d6bea6f9d31aa42c700aa799704 Package ships an empty module index.js = 'module.exports = ;' under a name that resembles internal tooling, published at an inflated version 99.9.1 —...

Malicious code in knip-bun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d412258df9a21f510333926a9be29bed8ae6368e549e295c84e187bdc1a3725 Package knip-bun typosquats the popular knip linter. The main module is an empty stub module.exports = , and package.json declares a dependency...

Malicious code in eslint-generate-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4478598213eba844460a99bf323ef024e2fb906c918736cc7e593745029e16b4 [email protected] is a hollow package whose index.js exports an empty object and whose only effect on install is dependency resolution...

Malicious code in eslint-publish-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3befb9fa08cae88e2ebcfb7877a33453bc0b95e0876fb5f76d55b011c8c9869 [email protected] is a hollow package index.js is an empty stub, no lifecycle scripts whose only effect on install is dependency...

Malicious code in resolve-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c [email protected] is a stub package index exports an empty object whose package.json declares its only dependency ltidisafe as a direct HTTPS...

Malicious code in @hzero-front-ui/cfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d280060b3d704c67c4a2cc853fde425220e6a3606f71269daa8a9b3e74052f6d package.json declares preinstall and install lifecycle scripts that, on npm install, collect whoami, hostname, current working directory, and...

Malicious code in @hzero-front-ui/c7n-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 836c7ea4bdd57db38273e1e017c5a977d397cf321d36e5dbdd8060fbcd8ca08e Package @hzero-front-ui/[email protected] is an empty library whose only functional code runs in preinstall and install lifecycle hooks in package.json...

Malicious code in @hzero-front-ui/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7821a8d1a76ccfc9b3e0649ad6b600927c9c3448ee083d47809026588daa77ca Package @hzero-front-ui/[email protected] is a hollow shell index.js is only module.exports = ; whose sole functional content is preinstall/install...

Malicious code in @hzero-front-ui/hzero-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1b33c04eb2fb12d521b76353993517475d9239c9790c085d16c0c3d0a4ba2f9 Package @hzero-front-ui/[email protected] is a scope-lookalike of @hzero-front/hzero-ui with a placeholder version, empty author, generic description...

Malicious code in @hzero-front-ui/themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac0df9dcfaeaf0958ef981d9c5cd9dd4ab1fe0de41bd20894c261dade6bb486 package.json defines preinstall and install lifecycle scripts that run automatically on npm install. The scripts collect the installer's whoami,...

Malicious code in xrblocks-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76393473878ee61f371bcb238c278a7ae68f2a802d5a8b017d72812ab61c3c09 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers hostname, platform, arch, node...

Malicious code in tizen-webdriver-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf90f542c0f81ff50f903a216f44a5870bc0ac5ede472fa2c41af447994b58e4 On npm install, the package's postinstall lifecycle script collects host identifiers os.hostname, process.platform, process.arch, Node.js version,...

Malicious code in nc-verify-127942 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ea69188e179cd73aa9f200d63e8faceb5d3aae622a8fe2d86bf7ae761b5f1e0 nc-verify-127942 declares a postinstall lifecycle hook "postinstall": "node install-cb.js" that runs automatically on npm install. The install-cb.js...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Malicious code in external-process-live-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751 The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 with a 'bearrtoken: logo...

Malicious code in @leonardo0902/vortex-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9 The main module in @leonardo0902/[email protected] issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passe...

Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...

Malicious code in vexium-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9 On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credit...

Malicious code in @kolbo/mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967e165bfca294b333ff71265b77d931215a540b48158d2050a4a516ca51e7c src/auth.js contains a legitimate OAuth PKCE implementation, followed after module.exports by a top-level async IIFE that runs when the file is...

Malicious code in ventra-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f023d55f53d30a92c8f06ca661862ee99d338f6d3719247c9390b3169009702 The package's default export module.exports = = getPlugin issues an HTTPS request to a hardcoded bare-IP host at 31.97.137.157:45000/icons/116 and...

Malicious code in prediction-trader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87 index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch variables named iconDomain/getPlugin,...

Malicious code in velora-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb [email protected] exports a getPlugin function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and...

Malicious code in chai-as-reformed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45 The package impersonates chai-as-promised and copies its README from pino, but its exported middleware spawns a detached node lib/caller.js process...

Malicious code in functions-framework-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node...

Malicious code in cilm-ui-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008641dff89b7e4b86993671997e965642fab5620006c5ece0827f0fe72fe0d9 On npm install, the preinstall hook executes index.js which collects host identity data os.hostname, os.userInfo.username, os.homedir, current workin...

Malicious code in copytrade-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00c8773c5727069f87e54d58cd3679252a90ec0fe3de3a1b4adcb9a3bbff68bd index.js exports a getPlugin function that issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108, takes the...

Malicious code in fmt-util-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e8613ffc5393a31685344c247925a5ef104f7daf3f0d2f45a51918adba7d344 [email protected] advertises itself as a trivial string-formatting utility index.js exports two-line pad/trim helpers, but its package.json declare...

Malicious code in process-live-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a36d35f64443b9dc4a2395017b8738562a321c9765089f916eeebdf58281d57 The default export getPlugin issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 and passes the returned...

Malicious code in @ethers-js/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06aee7d1e943a9d9a705acf4f28286eb5460ab9a56057a0811274787478f7c68 Package impersonates the ethers project real releases publish under ethers and @ethersproject/, not @ethers-js. The postinstall lifecycle script in...

Malicious code in @opezneppelin/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab @opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script scripts/postinstall.js hex-escapes all module...

Malicious code in npm-hex-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0f1f9004b6a502c144d4d475e89a3956905aebf51fb2696d4ba05c21613727 The package's postinstall runs runtime.js, which POSTs os.hostname, os.userInfo.username, os.platform+os.arch, Node version, and OS release to...

Malicious code in js-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe The npm package js-assert-plus masquerades as an assertion library homepage http://js-assert-plus.com and bundles the real chai source so consumers g...

Malicious code in minimalistic-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75 The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require'minimalistic-assert-plus',...

Malicious code in power-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823 power-assert-plus is a typosquat of power-assert. On every require, index.js detach-spawns node build/power-assert-plus.js. That build file is...

Malicious code in postcss-initialize-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79 postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from...

Malicious code in debug-proxy-chrome-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c [email protected] declares a postinstall hook "postinstall": "node install.js" that automatically executes on npm install. install.js...