Malicious code in dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405e9f78919c848257f022e90ba1326206bee394ec4873cb08b846688258ef15 Package 'dowloadebokreikisviluppaeusalenergiareikibymattharvey9q55p' at version 0.0.0-stage contains only 2 files and shows no code-level behavior of...

Malicious code in dowload_ebok_armageddon_by_max_hastings_kv3s4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69968aae3c0971eb7e0aae79515930942260191d6a07871fd8fb6f863744b372 Package dowloadebokarmageddonbymaxhastingskv3s4 version 0.0.0-stage ships minimal content with no executable code, no lifecycle scripts, no network...

Malicious code in dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097a05ce21d55f308b754a0dfea3bc1d16b0096187cb6201926527754781fd56 Package contains two files with no a static rule matches and no traced installer-harming behavior. No lifecycle scripts, no network activity, no...

Malicious code in dependencykfeg (npm)

dependencykfeg 25.0.3, 25.1.3 and 25.1.9 contain no code of their own and declare a single dependency that npm fetches from a tarball in the GitHub repository GamerD11/pingtest https://github.com/GamerD11/pingtest/raw/refs/heads/main/node-acct-utils-1.0.0.tgz, whose preinstall script runs node...

Malicious code in bq-helix-build-hook-6ade983e (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ff13fe63e15fdf4130e7219776edbe4d34fe2c2b83011099a0ddec9c10ebf6 On pip install, setup.py collects the full process environment dictos.environ, process command lines, and /proc/self/status,cgroup,mountinfo,fd, and...

Malicious code in bq-helix-recon-6ade983e (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a2ea78473cb414982a67f3fa93db3427b98c6e3bcc5d70f6bbb0ededba7791e The package ships bqhelixrecon.pth plus sitecustomize.py/usercustomize.py that invoke bootstrap on every Python interpreter start — including pip's o...

Malicious code in orderbook-volt-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ba686d403966bfe8a9b5e8103e620c506d7e9d2823f6896b6be87409f9cc06 Package [email protected] was examined and no indicators of installer-side harm were identified. No lifecycle scripts fetching or executing...

Malicious code in dependencykfee-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bb75f6ebc23c1e1ea6fc3ae422db80b65e8f9b8d7c21faa2de9c58ba049e9d89 The OpenSSF Package Analysis project identified 'dependencykfee-2' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in react-native-drago-callkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9df4250c447fe422966a254b974db832e444643ae8a106e29266ef04e55a51b Package react-native-drago-callkit at version 0.0.0-stage ships only two files and exhibits no observable installer-harm behavior. There are no...

Malicious code in @chatunitycenter/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bc43e71e1158fc102445f53b3880fe32a99bb6a8557b99d1b17279e8f41f44 package.json declares libsignal as github:chatunitycenter/libsignal-node with no commit SHA, tag, or integrity hash. On npm install, npm clones the...

Malicious code in 789bet-login-th (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf974d2b6e808204775e9ca87b873c9099e447c29af9ea50d1c1ef019c1f25c The package ships minimal content 2 files scanned with no lifecycle scripts, no install-time or import-time network activity, no credential or...

Malicious code in 789bet-vip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4abb3e4b3a01fecb2b28af9d833cb422943367e8901fabd11cff9125ed891305 [email protected] is a minimal npm package 2 files with no install lifecycle scripts, no network activity, no credential access, and no executab...

Malicious code in 789bet-entrance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 295f8b8f5baf42f21b1074ef117ca1fc75ab60bf19c3b4f12455383578cf2ff1 Package 789bet-entrance version 0.0.0-stage contains two files with no observed install-time lifecycle hooks, no network beacons, no credential or...

Malicious code in 789bet-slot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90b63e837d3e39a58d2c23ec21d1909496d6a881a3a96fa42767fa87db90d2b1 The 789bet-slot package at version 0.0.0-stage ships only two files and contains no executable code paths, lifecycle scripts, network activity,...

Malicious code in 789bet-vip-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91d31f1075e7f5e6631dd7dd1fda86b2a75dda2cf5313576ed51d9a803cd7ee8 Package [email protected] ships two files and contains no executable code paths, lifecycle scripts, network calls, filesystem reads, or...

Malicious code in 789bet-vip-online-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b80989abaae384f9ef46a0a729b248e21f8e0afb73d56cc051fa3f17d3e1070 Package [email protected] ships only two files and contains no executable install-time hooks, no network activity, no credential...

Malicious code in 789bet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 982145beb113ba54f6c9bd11237c8a603a465d6912175a27dadcff3b72fb2182 The package consists of 2 files with no install-time lifecycle scripts, no network activity, no credential or environment reads, and no code executio...

Malicious code in m98th (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector affe0f39dc539ebc88bb056595ac821969f59fbe3430c5e1465178396b5812e0 Package m98th version 0.0.0-stage contains two files with no detected malicious behavior. No lifecycle scripts, no network calls to attacker-controll...

Malicious code in m98bet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824a76afd7e7916bcf5056e72d7486a3be06a847e407dff3a1417873ecaf9095 Package [email protected] contains only two files and no install-time lifecycle hooks, network destinations, credential reads, or executable payload...

Malicious code in m98vip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be41525afad86d596ecb8f7d28c8ac31b014cf81f337a0f3a548ccd8659eb452 Package m98vip at version 0.0.0-stage contains two files with no detected installer-facing threats. No lifecycle scripts, remote fetch-and-execute,...

Malicious code in @pcb-dp/qa-commons (npm)

@pcb-dp/qa-commons is a dependency-confusion package with no functional code its description is "Authorized Test Package". Its postinstall script runs node ./index.cjs on npm install, which POSTs the hostname, home directory, platform and CI provider GitHub Actions, GitLab CI, Azure Pipelines or...

Malicious code in @mobile-platform/magnetic-components (npm)

@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves @mobile-platform from npm runs its code instead of...

Malicious code in @jasperquinn/postcss-motion-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2b00f98b05ef64aa83ba1f6d04dfcd96791446c4c45e34f5b5855c56ec2eedb Package @jasperquinn/postcss-motion-helpers at version 0.0.0-stage ships a minimal file set 2 files with no lifecycle scripts, no network activity, n...

Malicious code in black-spindle-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90 package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embeddi...

Malicious code in poc-revshell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a poc-revshell 0.1.0 ships a reverse-shell backdoor that fires both at install time and at import time. setup.py registers a custom install cmdclass...

Malicious code in cjlowuxbnexkhgpzq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d1d7f624932b32c72ee705c215fadc8c0d4840b7102b390674f2df1fedbb92 Package contains only index.html declared as main and no JavaScript, no lifecycle scripts, and no other files. The HTML is a Cloudflare-styled page...

Malicious code in bcxhdh1kjlopsde (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a98b6cf73bddc57accbb5d63bf8d9cb945030577de427c32ec3eff5676badff6 Package [email protected] publishes a single file, index.html, declared as the package main. The HTML impersonates a Cloudflare Turnstile...

Malicious code in mw-communication-client (npm)

mw-communication-client was published to npm on 2026-10-27 from 06:55:13 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 10.0.0, 1.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in mw-test-utils (npm)

mw-test-utils was published to npm on 2026-10-27 from 06:56:36 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0, 10.0.1. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in mui-wrapper-x-date-pickers (npm)

mui-wrapper-x-date-pickers was published to npm on 2026-10-27 from 06:55:20 UTC by the account amahrou1w, about one minute after npm's staged-publish placeholder 0.0.0-stage, in versions 1.0.0, 10.0.0. The three packages mw-test-utils, mw-communication-client and mui-wrapper-x-date-pickers were...

Malicious code in monte-md-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in noxleyss (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @rennnpm/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in seapy-ops (PyPI)

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden...

Malicious code in @testsecuiitytestme/cache-helper (npm)

This package installs a credential stealer and self-spreading worm. On a developer machine it exits under CI, in containers and under a debugger, the install script loads a prebuilt native addon that decodes and runs a hidden, obfuscated Bun program. That program collects npm, GitHub, GitLab, PyP...

Malicious code in dsh-volcengine-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d3dafa3da7dea0655bf429e4da622be99e705dd12cbfffb381a0f987f6b550 Analysis of dsh-volcengine-provider 0.2.8 produced no evidence of installer-side attack behavior: no install-time lifecycle scripts fetching or...

Malicious code in zystcdemo (npm)

zystcdemo presents itself as a simple date formatting utility and runs its postinstall payload on npm install with node postinstall.js. The payload collects the whoami result, hostname, platform, and current time, then sends them in a POST request to https://srctest.zystcc.cn/collect; npm account...

Malicious code in dsh-redteam-mode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b10e8cb5b42b044dde881818592b20e43d2166d6641bd657bf90c2aa5a0c0a2 Package name and shipped file names score-rules.js, report-replay.js, store-core.js, tools.js, client.js describe an offensive-security / red-team mo...

Malicious code in @dmangal/curse-dependent-ecto (npm)

@dmangal/curse-dependent-ecto contains no library code index.js in 99999.0.0 and 99999.0.2 only exports its name and version and was published on 2026-10-28 between 21:59 and 22:19 UTC with inflated version numbers 99999.0.0 to 99999.0.2. It ships a binding.gyp and package.json sets "gypfile":...

Malicious code in spectral-core (npm)

spectral-core contains no library code: where an index.js is present e.g. 3.0.12 it only exports the package name and version. It ships a binding.gyp and package.json sets "gypfile": true, so npm runs node-gyp rebuild on install, and the binding.gyp declares a build action "Finalizing spectral-co...

Malicious code in b20miner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4987b21d454aad64b26fee42ee36d0d0e2a8b733dc23afbd0c7fe9bb3cd9e631 No install-time execution, credential access, network exfiltration, dropper behavior, or backdoor mechanism was observed in this package version. No...

Malicious code in @zaip-ai/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e44ea3cafd9835a85d3305b6aa9ed2f5400546938c6430c19a30cbdc5398936 @zaip-ai/[email protected] is a CLI package whose shipped files trigger keyword co-occurrence patterns curl/wget/ping tokens, Buffer.from base64 decoding...

Malicious code in itsa-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efba97f94ff89238d70b9715f9f85dea58617cc13e827ae163fdec80d00cd30b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in itsa-react-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64de48442d38106cf6ce795da22aab4b4ec88546cce9d63883761e944f41c445 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mock-transactions-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd727a8b4413f4809193cfac838d9b42ddae62a685086036a026ba2a4e7419e4 The package presents itself as a mock-transaction data generator but ships a dynamic-code loader. index.js builds the identifiers 'setTimeout',...

Malicious code in transaction-info-generate-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 043746546ca7cd9fc1679b0ee751cf12dc1938ba9f3b218dfbd090312f45a8ef Package [email protected] ships a minimal file set 2 files with no detected install/import-time side effects, no lifecycle...

Malicious code in black-spindle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dd746168a2e733a835005f5fd321e1bab9a24688a4c5d413247ae065ea29786 [email protected] declares a postinstall lifecycle hook in package.json that executes curl http://778e-181-63-25-28.ngrok-free.app/test on every...

Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in @zmtcdn/ui (npm)

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environmen...

Malicious code in identity-two-factor (npm)

[email protected] is a dependency-confusion package aimed at Coinbase its README and postinstall.js say so, and the beacon path is cbhq-canary with no functional code. Its postinstall script runs node postinstall.js on npm install, which writes a marker file to the temp directory and...