Malicious code in @my_name_is_khn/express-security-tool-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb45d8539214aba2ca98223064b29e9fac2199f766f7e44430ba9f9b4d2d622d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-self-destruct1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efe4bb7647313d9772c059e46a877ab095ada0910845e5605fbb317ab2b01fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in random-ua-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 543206058a0b8e85c8227a0bfdd4752fc61779b24968a0bd5d50ae6b3040387b During import, the code starts a keylogger and exfiltrates data from cryptowallets. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in @ks-radar/radar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe5f14a06be3c24f9b771e8bbe33139614129069d276962f0c7e019fd89cbce On npm install, the package's preinstall lifecycle script preinstall.js reads a hex-encoded command string from preinstall.json, decodes it via...

Malicious code in blessclient (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82efbe82f1f4cdc513a33b4deeb7a811318155aaf4de1d4319dc54f8730f409b The package name matches Lyft's internal python-blessclient and is published on the public index as a dependency-confusion tripwire. setup.py overrid...

Malicious code in swiper_angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...

Malicious code in whs4_deu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb5c50b57f755039aeebab19cba308fd86dad10eddad29a94ab09396fdfe6f5 package.json declares a postinstall script node index.js that runs automatically on npm install. The script resolves an absolute filesystem path via...

Malicious code in wsh4_edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...

Malicious code in whs4_eud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5 [email protected] declares a postinstall lifecycle script node index.js that fires unconditionally on npm install. On execution, index.js POSTs...

Malicious code in page-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99958415864bd2ddd266b99c59cdc35841e7efd9eff38481d69f4e740badd958 On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home directory, DNS server list,...

Malicious code in identityscimapiserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e866098aa6115f837577cc3b24eae409fb1fb67167757f2f0c5517dfa9d8d209 The package's preinstall hook runs index.js, which collects hostname, platform, architecture, home directory, and DNS server list via the Node os...

Malicious code in xo-member-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4180bb77cfdee32b5d3547f4edf9c8962fb4bbe6ee595275241cb0871d2371 index.js runs as a preinstall lifecycle script on npm install. It collects host identity and network configuration — os.hostname, os.platform, os.arc...

Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058782981a80d3fc90af74a840a00cefa0c58b9861c481d0444b7f4f3e6a014b On npm install, the package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir,...

Malicious code in preferenceslifecycle-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e33d1db03ba9b9f1d9dc9f4c81a574e5baa69549e6c1897230540fe15d2749a3 The package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir, and dns.getServers an...

Malicious code in merchantprefsservice-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145fc1d224cc012a8cbdea5823b1573df6400ce6a24837b2c25710772152724f The package's preinstall script index.js executes automatically on npm install and collects host identifiers — hostname, platform, arch, home directo...

Malicious code in gpaas-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f698d94fead72f888459a0773a7715dd974433c4624134b743098b61e74f9a9f On npm install, the package's preinstall script runs index.js which collects the installer's hostname, platform, architecture, home directory path, a...

Malicious code in pp-react-ui5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee26042aed9ed8c50ffaa9b8fd40df265099c14441c38542bbfce3c529ceef3 Analysis of [email protected] 4 files surfaced no behaviors matching supply-chain attack classes: no lifecycle scripts fetching or executing remote...

Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27087d7e447aae7f5009468024ead0904a706c36775c9a132b43bbcd47d3993c [email protected] declares preinstall: node index.js in package.json, causing index.js to run automatically on npm install. The script...

Malicious code in fundraiserservicepp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6356b654b692d4c1222f3dc31dcfad683a6e193a41484d3c617c7c8d52db2313 On npm install, the package's preinstall lifecycle executes index.js which collects os.hostname, os.platform, and os.arch and POSTs them as JSON over...

Malicious code in trongridy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a437be8ac21a8c375aeb02c4ab825bce027392f95aa356491950536454d2bf58 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in clerk-next-fix-auth-protection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fd8aaf2fc6ca964eed6950b6868486125905bacabe6b8bb1cbd581bb6a59f4c [email protected] is a typosquat of Clerk/Next.js auth tooling that ships no functional code declared main index.js is absent from...

Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...

Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...

Malicious code in app-data-lts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f9d67601ec8b46265e1f23f5e48ff5beb050626f4bc156b291cb1b8f8c36d35 package.json declares postinstall node test.js and main: index.js, but index.js is absent from the tarball. test.js executes require'.', which throws...

Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...

Malicious code in intel-cicd-repo-infrastructure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...

Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...

Malicious code in eth-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bdbbc1ccc748bfe5ad640ed4e54ed5285a526a78a198ac2bf64727b7730d54d eth-slint is a typosquat of web3-core-subscriptions. src/index.js contains a clean 2119-byte copy of the legitimate web3.js subscriptions module, whi...

Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

Malicious code in chai-as-stringify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77eb9f214b2dc10f13ecfd3239542bc27fb35bdd5d0a645b41b398d8a4a3965d [email protected] is a typosquat of chai-as-promised. The tarball ships lib/config/config.env, a 4MB heavily obfuscated JavaScript payload usin...

Malicious code in yuinpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f439dbbb74a729ef5c43bdc62f612060dbc9e6a96b825c8305b88dd43b3172 Package [email protected] contains 3 files and produced no a static rule matches and no traced-code findings indicating exfiltration, install-time...

Malicious code in eth-codergen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dda2a0fbfa98304482ef90da4f137c863775959e107fccd495311fcba4fd185c The package is advertised as an Ethereum ABI code generator but its index.js is a verbatim copy of the unrelated mongoose-lean-hooks plugin. Appended...

Malicious code in svelte-streak-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45dbfe79dd6fb079811b798a734de0a661605d420454d97a0635dbdaec621efd The package contains no static or traced indicators of exfiltration, install-time remote code execution, silent-relay, credential distribution,...

Malicious code in streak-lib-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...

Malicious code in streak-bucket-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ac54ede0c029cfc28fa42ff5bdbd04ea17ebb610987c50a9108912588a82c The package advertises pure calendar/streak math but its main entry index.mjs schedules an async routine on module import via...

Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc009d2d22b9f02aa6b2cce1ac5eadfcb3f3a7d437cc2ba031eb1e6154da2a4 [email protected] shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, backdoor, or self-propagatio...

Malicious code in fs-extra-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397f5c6f4eb2cf734d5ee1afc9908bdd0162a91a2fc6ad6d7d51a5cfd22fdc41 Package impersonates fs-extra by copying its description, homepage github.com/jprichardson/node-fs-extra, and repository metadata verbatim. Its...

Malicious code in vitest-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e61d93e82877f836aaba3dd528e79f3e5f4b1bd12ce64b40202bbecd08a2747 Package published as vitest-axios re-ships axios source, README, homepage, and repository metadata to impersonate the legitimate axios HTTP client. I...

Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...

Malicious code in da-sc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af0c0528114fb5ac6296c3390b435a78ce9dc9f0d90fc606a6cf5d05b3472f0 No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltration, install-time remote cod...

Malicious code in aio-commerce-lib-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9479591a21dd21e28dbd04aaf239e1da57eae40a248247d8e270d8e6f1278fdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...

Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58, and index.cjs re-exports...

Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...