Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

Malicious code in llm-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669 Package presents itself as an LLM SDK nebula.js exposes a small client stub but declares preinstall: node preinstall.cjs in package.json, and...

Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

Malicious code in nebulaai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e The package's preinstall.js contains a base64+zlib-encoded 257 KB Windows PE executable. On npm install on Windows, the script decodes the blob and...

Malicious code in figlet-chalk-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5ccd0a988525d8128b520a46c4271e26ae5fe2f99accf28f37d4c7370b66de4 On every require'figlet-chalk-render', a top-level IIFE queries https://registry.npmjs.org/figlet-chalk-render/latest and, if a newer version exists,...

Malicious code in chalk-figlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry...

Malicious code in nebula-llm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...

Malicious code in fabric-render-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01 package.json declares postinstall="node index.js", so npm install fabric-render-bridge automatically executes index.js. index.js reads Minecraft...

Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

Malicious code in img-to-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7676788d88c2194b8d5c048decfbe06550798ce342af54f8975bc26422d10c53 On require of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended afte...

Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...

Malicious code in nebulajs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07debd960454b52639fee783e21c0c303702d8dce6de5e3320393f1b0abc7077 package.json declares scripts.preinstall = 'node preinstall.cjs'. preinstall.cjs is a single 232KB opaque Function... invocation containing a custom...

Malicious code in nebula-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0ca45fda7abd51edfeef37be6d19b4070788180b7625f16354223d81dae4d45 The preinstall.cjs lifecycle script embeds a base64-encoded, zlib-compressed Windows PE 257KB as a string literal. On npm install, the script decodes...

Malicious code in vite-plugin-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ee82c069dcdf259199f5844c6ff46be3020d79609ff7b7b8ebc82017c59b2c [email protected] exposes a Vite plugin factory whose body concatenates three option fields — secret, salt, and iv — into a single string and...

Malicious code in tailwindcss-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee530ea41c8bfbb1574bee19e02b9bf7f319e9dd93300513f4be599eebbc3db The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in my-skibidi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02c4b3433d9f819c70b6ec69fe7bcc0ae0a7ff48540e11394ea5fb8f3c49049c [email protected] contains top-level code in its main module that unconditionally POSTs document.cookie to the hardcoded remote endpoint...

Malicious code in eslint-plugin-skywagon-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...

Malicious code in git-en-boite-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ebee9f4428d7f14f6f941438064715c8bece34c5fe6bfedf32bbd8cba226c0 package.json declares a preinstall lifecycle hook that runs wget to a hardcoded webhook.site collector URL...

Malicious code in godsplan (npm)

Running the godsplan 3.0.2 CLI connects to Chrome's debugging port 9222 and injects JavaScript into every open page. It bypasses Content Security Policy and intercepts selected test-page requests. When triggered by a mouse gesture or keyboard shortcut, the injected script collects the page text a...

Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

Malicious code in wbnr-probe-visible-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d776962e1dbbc52e380986c97788bc3fa67272b049d153c25265481ebcd84161 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @wbnr/design-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3b05ae1cf2f1c184b793a46f4bebd59f7945ef1f671c4e6bd64ee946c416e2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wbnr/lottiefiles-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f4124e4c91354a00657c25874fb6b9f762438eee2ecd1d8b686af3d4d4ea8c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kalasnik-npm-simple-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1463688412306d5d6f791bb036bea59aeb7251a3044a52c57119768f27cd463 The package's postinstall script senddata.js runs automatically on npm install. It reads C:\temp\test.txt from the installer's filesystem and POSTs t...

Malicious code in kjj81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4c29ba9ea960c7f8e350f68be2c3a6dc320bc3e230be0fb6c8f30d186b1417 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in uuid-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1794c1dba5ffb902f0c8011a60990baff7cf5ebc1f90ab634937734944696995 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in riot-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b944a9e85b91a70a2c0f84390f4537b2b1babed308cb23c165bf61bc20a91769 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vinzzsync-wacli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6515588ac57ec4218f28d221b4c94d785d9455f03c0c6ae27b97fc66fdd6db5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tanksync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45dcd24fc5596e9273938687d6878a8927fcdf9ffd63982034556e84c3339065 The package's advertised API downloads a JavaScript file over HTTPS and executes it via spawn'node', payloadPath, detached: true.unref, leaving the...

Malicious code in @consts/links (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddcbc6f472b5dba063f65d700ffb3669e4b33c439ec16445d623240b028202a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @digi-kernel/digi-kernel-constrains (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cf968a9064d02510a559a3850f8fbbda22f6fc038605569e6f6939a139aa115 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bb1ptest23/test-paket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88718be23e6bf753453adc1110580e87b675e7881b945d419746afe4bebcfa5e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ossf-package-analysis...

Malicious code in scrapetools2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233 scrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways eu.orbitor.dev, dget.top,...

Malicious code in aseity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e setup.py invokes aseity.compat.ensurecompat, which base64+zlib-decodes the DATA constant shipped in aseity/shimdata.py and passes the resulting Pytho...

Malicious code in caracas4check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...

Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

Malicious code in metrics-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60ce93696722d633e9eea7b3fac6f76ebe61a581bd2d1d79efb778f8cb015399 metricssdk 999.0.0 is a dependency-confusion beacon. setup.py runs on pip install and metricssdk/init.py runs on import metricssdk; both hex-encode t...

Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...

Malicious code in donutautosellsrc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb setup.py invokes a module-level trigger that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run, which...

Malicious code in requests-cache-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1655ea47fc7ccd39294203776ee3dcb01a394c40d93e05b7b527700b19de42c8 During installation and importing the module, the code downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in chai-as-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line 4.4MB obfuscator.io-packed IIFE hex-escaped...

Malicious code in cma-self-hosted-sandbox-cf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d91a7568b717361d5b3727d46e8bf567fc038f95c5fa22c5222a272460bb9f35 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the machine's hostname, current user info, home director...

Malicious code in sherpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf The sherpy package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at...

Malicious code in @digift/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 103ec4b63e45d1bc9b3e3c2e616eedfa134f9f8bdcb6480f33fbbaa280038803 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nubjs/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b292cfe4598353bc8491677099fd2c056f4136eb686345bbdbe68fa887e368c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zeronexcode/baileys (npm)

makeWASocket in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it...

Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...

Malicious code in shoplist-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6 [email protected] is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook preinstall, install, postinstall...