Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

Malicious code in chai-as-bench (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 487af469d8de2a3caa5e798df3a5d56e59b795c1ddc106abd1d38ed855b6fb17 The package presents itself as a chai plugin name resembles chai-as-promised, manifest description references chai assertions, but ships no...

Malicious code in chai-as-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953 The package presents itself as a chai-related utility name chai-as-map, keywords logger/stream/json, description referencing vulnerability management...

Malicious code in chai-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d61869c26ad8015b88350d312fa37f5e18d536794ce5d8c46bf4239b2154b1a9 chai-tracker mimics chai-spies matching name, README, and keywords but declares peerDependencies on dbconnectify pinned to 'latest' and axios. The...

Malicious code in iconova-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4590534a7b05eb30959d9422e2ea700fb525b66b357a62f7ba1795caba4ad799 iconova-react is a re-hosted copy of lucide-react every icon file carries a @license lucide-react header; the package name is iconova-react but its...

Malicious code in @kuperka/chainguard-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b799ca087f4396cb295cd53012a92d10dea0c763a41c8b85e94437108ea24e4 Package @kuperka/[email protected] exposes a single payload, window.VEIL.init, that on load harvests document.cookie, every...

Malicious code in @rblxts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0 @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names 'fs','https','childprocess',...

Malicious code in postcss-initial-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e88db5eb44ddcfa3cd22d46e8b6e6a1cd2e7da25a5942d35550d50f2cbbb9ea3 index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints 1rpc.io/eth,...

Malicious code in chai-jsonss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1fff32102bc74783cae571646ec0fd68b14c614b35a63badd814a64caa3b67 On import, index.js invokes postCallers which resolves a base64-encoded URL stored in lib/const.js decoding to https://1uznbx.s.gy/7xdQmt, GETs the...

Malicious code in @noobaihome/amis-simple-area-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642f206459c4677892954c26736b990c72bb01ae9383f917ab664b38d977819f @noobaihome/[email protected] advertises an AI Suda amis area-chart widget, but dist/renderer.umd.js and dist/plugin.umd.js are empty stu...

Malicious code in @noobaihome/amis-uni-area-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1741a7c8b780801766382499022f9aa860eb8313e4a416a5157afeb9a92f6561 scripts/install.js runs during npm preinstall and performs three attacker-beneficial actions against the installer host. First, it unconditionally...

Malicious code in cryptostock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454 index.js is an obfuscated payload that, on require, starts a C2 client against https://badai.run.place: it registers a UID, long-polls...

Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

Malicious code in simple-date-formatter-new-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5000b7987ca50d065efc0f5a3ba7c724cb73ac0e23f54347cff8b30aa6eb5d3b package.json declares a postinstall script that opens an interactive bash reverse shell to the hardcoded remote address 124.221.154.135:4444 during n...

Malicious code in simple-date-formatter-new-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1cc0707c5a58067075648ef1c040ceeb07c2550b9f06d53b5c8c41ec167c841 [email protected] presents itself as a trivial date-formatting utility but ships two attack payloads that fire when npm installs the...

Malicious code in tokocrytodev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...

Malicious code in chaintest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence...

Malicious code in pytablute (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89c8605077eecd12f249b3698da0cc2b60f54ecca01041a16221882d1ee6a4b1 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

Malicious code in @ssgw/icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9d2fb7b19baedba9c5350b19ebf8ab3e99be16bd04fd15a3960889766ed97e70 The OpenSSF Package Analysis project identified '@ssgw/icon' @ 9.999.999 npm as malicious. It is considered malicious because: - The package...

Malicious code in btcflx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...

Malicious code in btcflip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970 The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory C:\Users\Documents\Monero on...

Malicious code in kotoraka (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

Malicious code in kotanku (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2281ff1cf735f26084f13f5f3ef5e1d5f9faf8cf06254532e5ee6d27204f52d1 During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

Malicious code in riakcs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3dada3cec22fb43bb528b8f4f7173bb346b25e373eaeb719af2df48698119240 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f33793b44bee99cf40ae7b4ecfdd4d8ab388edf96753862f96b289ad3e95d2 Package contains only 2 files and no code patterns indicating credential access, network exfiltration, install-time code execution, silent relay, or...

Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56afa18eac7769497f21431af2a739dd5040563541223e41786746e0c44957a2 Package contains 2 files with no static or behavioral indicators of supply-chain attack shapes. No lifecycle scripts fetching remote content, no...

Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e6f280e621703ad0ddfe97298c5a5dded61dd1b8fc877729ad0202f6a23a77 Package [email protected] shows no evidence of exfiltration, install-time remote code execution,...

Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd82004d1cbf2e4b6a3c77f48293b0d9638fe59592eb40291b6a332121f6fe6 Package contains no code paths that read installer secrets, fetch and execute remote content, relay caller data to third-party destinations, or...

Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

Malicious code in statist-browser-typed-client-eventea.projects.tdevice (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dbd4923fdddd3bf528bfd2bc560ffe7963b22ed9df844e60f6fe2f778f15720 Package [email protected] contains only two files and shows no code performing credential access, network...

Malicious code in statist-browser-typed-client-eventea.projects.pwainsurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4836c93e5c62158ffed799c206fa3713291692e10efae048c04fff0745f7070f Package [email protected] contains no code patterns matching known supply-chain attack fingerprints. N...

Malicious code in test-noexist-xyz-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6984c0cfd599175b528146e9bddb0ef6ad0ef07a21bc7dd78e6bdb195bd53d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...

Malicious code in @coralxyz/anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763 Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor hyphen removed. The npm postinstall hook,...

Malicious code in titan-exchange-shared-permissions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6 [email protected] is a dependency-confusion reconnaissance package. package.json declares a postinstall script node index.js...

Malicious code in modern-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5 On server-side require of modern-localization, the package's main entry runs a top-level async IIFE syncLanguageSystem that performs an HTTP GET...

Malicious code in localization-fixer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701 On require of the package's main entry, a top-level if isServer syncLanguageSystem fetches a JSON payload from...

Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...

Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3461050b5714edca455c0fd78e979cd5efbdfeeb375016aeb4fe4523f47682 On require, index.js loads adapter.js which selects a platform-specific payload linux x64/arm64, darwin, win32 and fetches it from...

Malicious code in sme-rko-finance-front-operations-tax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa On require, index.js loads platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in sme-rko-finance-front-payments-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8fcad12c3078bf2134f5e3cafd7ffa0ecf9f2bfec919533881d5c65b738b9fa On require of the package, index.js loads./polyfill.js which assembles a set of C2 hostnames from split string fragments via.join'' — resolving to...

Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05877cb287448f82b3b8a223454971cbd881ff8667e597472c04123697295220 The package is advertised as a finance/payments adapter but on require reaches a staged loader. adapter.js reconstructs destination hostnames from...

Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b5dcef9a8613b9de1b3bbd1137a65cdbf087a9a96543602fb3372d7eca978f On require of this package, index.js loads./loader.js which reconstructs C2 hostnames via array-join string concealment...

Malicious code in sme-rko-finance-front-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac On require of the package, index.js loads shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-stri...

Malicious code in sme-rko-finance-front-operations-other (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c11dc6f375e9ceaee8f1b8e40db07f49c88e7bc47715759b101d3513399047be On require/import, init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames...

Malicious code in sme-rko-finance-front-operations-fee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5 The package's main entry ./lib/telemetry and its vendor.js module execute a binary dropper at require/import time. Hostnames and API identifiers are...