Malicious code in fcogvspgigatanzcydfyvgtjhvxibyau (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d987ceb34687d7e3c37233198705c5db7f3ba49910be418829475c475d20b21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in time-to-reload (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae5b3b160cee5b4b48fd61cd4b3b3e8b1c97118b1ffcb0895fcd656d3faea62b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in datdbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3722aafe66ac2c253aec711db7cd1b2d0604d326c1520278ed712b02242e44f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in broccoli-watcher-siphon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 045a48ee2e7fb0e492e451c0144cf9b6072f56fcffa8b69808b7cf8e3a0f5b10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in impv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08ab943364555bc64aaa5949d20cb3976e5a47af1429a885373b91cf17c3f4c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in canvas-to (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20ad4ea01c4d87bc2fa2e6a27121b03d234dcdfdd8cadb702cb0ea28790f3ab9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in confetti-rebuilds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f2069e994966cd4c815277183b96ea19c7874fbced968edb527a4ba7a2d0697 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in srgb-linear (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 161f0f8d0598a57e1dde7ecb119f308f82a1bad8189fe8dce4bb88547559f588 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackageeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eeee23ed9e5f55520bb0d6712d26704bf87dc9badeec3180c33a6d2eb31cba9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackaged (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ff278946b863ce1334fc8565873bb2baf8f720e9ce156a940e407560677a6d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackageeeeeeeeeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa6e0b845a57f0b93fc4c94f5fcd848ad4208ef9c5043784b3f36b00baae782d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackageeeeeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45246ee20e180e2fad7d173c631adc54422700c677af4295a9624000fc6146fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackageee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77ab723570d52cee7414fec303ea92c8e373a39274923acd41456fb26832e30c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackagee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d72c36e7d1f592e7ea21cc7aaf3ae10e22eca202c7b2ae7e3cab34f08a5ea32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackageeeeeeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06c2af921e85f8ace3d552a18ccb5878291423bb74dd7ac4d26ca8dfa5bfeb66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackageeeeeeeeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f91dfa4ff998df4408f931ab845cd0e8ee28ea87257ee5e16a9193be3182e851 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9313a7f2668469165ec57294f516576c2931233838685e0268d818ffee416cad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackageeeeeeeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4224e482494116a176cc3738e50f3678bf9147ed6ff02a6720d890b6e563549e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @dotconf-pro/dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd637311af2fde11d791f9e88a5b58e602a1fe9f1ce5b91aa4780f9a09cb8ff9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @dotconf-pro/dotconf-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90ff28cd8e4235c7ea8692cf94b983e6ad3b735a22dac76f8e67d4a1153c7449 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rumjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb5296e68a31e1b0b076ac2f39cf7ab597f90a4582ff9072395f0b57834ed6d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @404c3s4r/testxxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bd0eb9a43f893d498f074432357cace7974802e77750075976412a8300599a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-metric-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76c232192bc12931cca4480eb306026c8ca4776ace0353ddb00fe7b947515b25 No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code, no credential or environmen...

Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

Malicious code in streak-metrics-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae3b140d6072d259b286e7487a69cd3babe3855ed26add10dbf664e9ac4aecb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-streak-metric (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc322e0a092d833331b172d9796648351685df0cc31d98f590288d859a00f77e The package contains no code paths matching supply-chain attack fingerprints: no install/postinstall lifecycle hooks fetching or executing remote...

Malicious code in thedata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...

Malicious code in switchpaymentsapiserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdf45ca375c6a15e134abf2ab456c8cbd75e514d934e2c16b1d2b23e9677186a The package's preinstall lifecycle script runs automatically on npm install and exfiltrates installer identity data via DNS. It collects...

Malicious code in consumerweb-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa886e4b335d3fc76fa6bc8e50c2e428ac164165830705c0ab2847857c2b3aa7 The package's preinstall lifecycle script runs automatically on npm install. It collects the installer's OS username os.userInfo.username, hostname...

Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f5e3f7f8e637ac814a5040b2e61c8608327f73b1c44352e694848a8c35e181 On import, server.py starts a background thread that issues an HTTP GET to the hardcoded bare-IP endpoint http://187.127.73.142:8777 carrying a...

Malicious code in ai-perf-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83 On import, the package's top-level init.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 usi...

Malicious code in create-backend-scaffold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0201b01c3bd9dbea597956acb10299aa22cd7976dcb7863348892f46512b47f1 playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer aliases require/module to...

Malicious code in pretty-log-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad32145cb24ae2a271cecb6379d30a531be17d84a0d71189d3a4afaec20af015 No malicious behavior was identified in this package version. There is no evidence of credential access, environment scraping, network exfiltration,...

Malicious code in logform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec6c47e9e94b571242404a22ce01e255dc1df012c3d13477b5d2db9a96a037c Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README advertises formatting...

Malicious code in @wbnr/design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd The package's preinstall lifecycle script runs automatically on npm install. It reads the installer's username from USER/USERNAME environment variabl...

Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

Malicious code in litespeed-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3af61c30e0a85b26bb59e521eb02a26c0b7071446d99d03cdf6b07f790b1f8 This npm package a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module ships a preinstall script and a top-level...

Malicious code in n8n-nodes-trust-me-im-totally-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bd22982653509931d8154fc00793d03ae037f78243500c749ff4f6c1274e73c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ai-plus/de-agent-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d124a211b34fae316341f17eee7b998a707e549691b9241d72289b4961f2aa12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ai-plus/de-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d50f0cb1eb732ea83ae7a1d6ac6b1c20aef7005b9aaac240d43b18a2d0dfe07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ai-agent-node/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bd9860fa6b32249720b90f9ba4f48642cbd746fe04e701b05cba6eef2951671 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ai-agent-node/agent-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8edd22e8454df2a9c10d47ea5c39560f9384598e7fb2a26b26b8f647fd5d2dd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

Malicious code in @zannstore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 708c069b088fb74064262b95a516de8d4b3f3128bd6705d98ee7e8dc10e942c8 @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to keyword co-occurrence of...

Malicious code in @peptide-unit/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in @peptide-unit/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d2db0b951057e42b31006e9bfd3752cde6db494df5959f44e0243f802d7a32 index.js is a repackaged copy of the legitimate emptyport/unimod peptide-modification lookup library with an obfuscator.io RC4 string-array IIFE...

Malicious code in colder-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd07744737c9b6e9ee846d8a15610b53170c6a0fa0937c00251d4b87697bea57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uniapi-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09d612d64d0f85043a8a38f0098a520182eada4e67046bdff3bd6bfd8bf150e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in def-open-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2ab83557d19fac6db95041a0557305c6950f0c181a3998767dfaf011fc02c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...