233081 matches found
Malicious code in rasterkit-demo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d748af7546aacbfca356759d4c81386f113a32dfc80ff8bb75da3eb3c8b4358d rasterkit-demo ships a CLI entry point rasterkit-demo whose rundemo function imports demochannelwindows from PIL.data and passes the returned buffer ...
Malicious code in fluffy-octo-broccoli (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f fluffy-octo-broccoli ships a 10.7 MB qiwi.zip archive whose contents yield no readable filenames or strings via extraction, alongside a run.sh that...
Malicious code in commonweb-rewards (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...
Malicious code in consumerweb-calurls (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 669d269ba4f32fdf1b9c8858544848525f323074fba69e9f84a2974504adfc17 [email protected] ships an effectively empty package empty index.js, no lifecycle scripts whose sole effect on install is to resolve a runti...
Malicious code in commonweb-card (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...
Malicious code in commonweb-moneymovement (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee7c2ba53e2c7adae6a2b54776c21490794ee8f28fde98f5c61778380de1382 Package [email protected] contains 2 files with no a static rule matches and no traced behavioral findings. The version number 99.9.1 an...
Malicious code in signzy-field-level-encrypter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38314f87203a0860a07c13fed06e2ec374545060b18be84a2d125556b93bc451 package.json declares a preinstall lifecycle script that runs echo "$whoami: $uname -a" | curl -X POST against a hardcoded Pipedream webhook at...
Malicious code in commonweb-wallet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1769ac1af054b70eedc630a2cda97a2d810ef7c8551a7e80b2f859f0c578d33 [email protected] is an empty wrapper index.js is module.exports = ; package.json has empty author/description and an implausible 99.9.1 versio...
Malicious code in cxpw-offers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2288ef5dfb841556f7ba4907a025270dfda3439820215b7d98e644afca78a306 cxpw-offers ships an empty index.js and declares its only dependency ltidisafe as a direct tarball URL at...
Malicious code in requestor-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8a60f357ab63e9818e450e4e4aec3dcf1b08d1242931ad5ad8468a460ee82ba [email protected] is a hollow wrapper empty index.js, placeholder 99.9.1 version whose only effect on install is to resolve a dependency declared...
Malicious code in chai-leaf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...
Malicious code in chai-as-reddit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...
Malicious code in ts-vitest (npm)
ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...
Malicious code in faust-cont (npm)
The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...
Malicious code in date-format-utils-xz (npm)
The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...
Malicious code in trongridmy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 17d343778bc5b25dea876fcf592e8e0267c3ec189ea931a6c73ab536894aabee Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
Malicious code in trongrider (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766a0a8222cb9a7a188ad8c88daf73b102036079be073f01661cde1622b99b5 The package exposes a function permprivatekey that POSTs the caller-supplied TRON private key as JSON to the hardcoded URL...
Malicious code in upjsma (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6da6be7241858aacc6bf0fdef363fad9469efcbd9414b7b6e3e4153eba341f7b The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a fullscreen iframe, and...
Malicious code in roles-royce (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378 rolesroyce/init.py invokes a hidden checkenv routine at import time that spawns a background thread harvesting installer secrets — SSH private keys...
Malicious code in defi-kit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d On import defikit, the module compat.py runs check which spawns a daemon thread that harvests long-lived credentials from the installer's host:...
Malicious code in tilaver-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...
Malicious code in s3-lambda-dynamodb-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6517c8914c4ba64ce57809484229df7fbe5dd9f5129c40b19cec8a73c10a70ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in lwc-slds-lbc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...
Malicious code in alb-lambda-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...
Malicious code in iot-kfh-s3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...
Malicious code in lambda-cloudwatch-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d62c2ab5388572a03d3c4f28ee268d562675a2ebbff48cf1375728f837365f4 The package's preinstall script npm install @sentry/node && node examples/verify.js executes on npm install and initializes Sentry with a hardcoded...
Malicious code in automatic-octo-invention (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2dfb4e3eedab24e355b6d24db6096e6752563e220d28e83ad2cf213fe49fd89 The package ships an 8.6 MB stripped ELF binary at automaticoctoinvention/claw sha256 f6fe45f8fe9081987505af31f0249021a65b558af514f2e4e37340fb3182805...
Malicious code in ml-core-airflow-auth (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a543a55b463967fa7f6b3c1462ecb38735072a4f4f47bf5f9b732e089a64b8a The package advertises itself as an 'auth token handler' but its public API src/mlcoreairflowauth/init.py exposes only a trivial in-memory TokenStore...
Malicious code in your-unique-package-name1337 (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in win-build-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bd3facc00c36861223058a572fbaa888d815a06c7b309c44639c544c65f1d9 The package name suggests a Windows build helper utility, but no concrete behavioral evidence is available to confirm or refute installer-side risk. ...
Malicious code in solana-web3-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0 Package name closely mirrors the widely-used @solana/web3.js Solana SDK while being published under an unrelated, unscoped name. The bundled...
Malicious code in solana-web3-patched (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99e6f959c8df3e2933c860ba3d36dc5dbbd27d97a69a3e97a5a7feaf7e24899 Package name 'solana-web3-patched' resembles the legitimate '@solana/web3.js' library and is published as an unscoped lookalike at version 1.0.0. The...
Malicious code in solana-web3-lts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed Package name 'solana-web3-lts' resembles the widely-used '@solana/web3.js' Solana SDK, raising name-confusion concerns for installers reaching for th...
Malicious code in solana-web3-stable (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38824d7f6044fd3177aba408a5f815879762d8829e56cb6692e2cad652f7d9e6 Package name 'solana-web3-stable' closely resembles the widely-used @solana/web3.js library, raising typosquat concern. The bundled lib/index.cjs.js...
Malicious code in solana-web3-fork (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 912cb41aa6b78cf62207dbf95f7d6247238483a800fa9bc6edd9b9d9f7819364 Package name appears to fork or imitate the well-known @solana/web3.js library. Bundled files lib/index.cjs.js and lib/index.esm.js contain...
Malicious code in solana-web3-fixed (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d36c0e75143828e4a93135d0c54fb34dd6e75588a493ade663a1fa4b231230c Package name 'solana-web3-fixed' resembles a fix-branded variant of the legitimate '@solana/web3.js' library, a pattern frequently used in...
Malicious code in solana-rpc-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57e3e79e60f9b8ec7f7c9b5199ecab2efaf72566eaed0f358a3b80adad5558d The package's bundled entry points lib/index.cjs.js and lib/index.esm.js co-locate require'childprocess', fetch/POST/GET calls, and references to...
Malicious code in golan125-homepage-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 705b0dc2e3b9aafb6d0e72ecb5ad51d873cd59104a045f74bb27161c87a24960 Package self-identifies as a security research test 'Security research test - do not install'. The package.json homepage field contains...
Malicious code in flow-eslint-oxidized (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in exodus-payments (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51394e5297d9dc765ee318eabd49e400b9f843c342ed91e3df9bd9befc84254e Package is self-identified as a dependency-confusion proof-of-concept. Its postinstall hook src/canary.js performs a DNS lookup and HTTPS GET to a...
Malicious code in exodus-checkout (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b10e41b9a87dc4927d3c4bc63b25bc1fa438cfae1bcf5f1d483204a18d5765f6 Package exodus-checkout self-identifies as a security-research dependency-confusion proof-of-concept targeting an internal Exodus payments SDK. It...
Malicious code in ecto-cargo-wk1tm59a (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee496f01ecebc77637213e597ba523c8cccda7efcd65e7ad2e700d804553dd29 Package [email protected] exhibits several contextual red flags worth human review: a randomized-suffix name pattern -wk1tm59a typical of...
Malicious code in claude-code-timer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04950731ec6589eebae22166fb042e4253719f71bfd3fc2b58f28d26ede9e43c [email protected] was scanned with no findings of concern. No install-time lifecycle scripts, no outbound network calls to attacker-controlled...
Malicious code in bytecraft (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b4433b369e2ff82bc33b11110ddfa63c15a2d685bf3484fb37092ae4bd077f No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity, lifecycle scripts fetching...
Malicious code in analysis-chart (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @public-for-cdao/utils (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @public-for-cdao/signer (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @public-for-cdao/deploy (npm)
--- -= Per source details. Do not edit below this line.=-...