Malicious code in secure-test-browser-1uomcu7q (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 065038821e6213ed8ec935ee42c9c1a199057267a1817b6ac567c2027b9394df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-7lp0evnc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc06c7b6344fb726a105a40a34e33033f9035a917b89ca4c73cf10e976d15063 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-ezbajpcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f72332762c242f4b79ccf79c0d87caf5578be04c48f34e87641979c5bc8521d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-1yjarnvk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7995072543002e808e597ccfd49ae3d1497ac3073f3afddee765664f8cfc446b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-z6d4ruii (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11a9076c20cb4bddfc1ad8237c6fc02e7ed3400076921662f8812f4d4c4f8849 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-r270knja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3c235aa5b2d461c2f9ddef4695c30e516ebc61b94161361ce3f9871fc1ae1ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cacao1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8 The package has no advertised functionality empty description, self-referential dependency on its own name at ^9.9.9. Its package.json declares both...

Malicious code in yamlformat-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in yamlformatter-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef2cbf7d7c360d11860ea9383a1ed84b491e75361f994359fd97284a5d25cdc2 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

Malicious code in @fleetbo/svro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d86373813cd4d2b65edb11f6a3f352ad81a55e7de0444884f66b0adb482e661 The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled identifiers 0x56260b, 0x12d64...

Malicious code in @znan/wabot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e857d5e68584a6a0b5bde34073d45d16540ddda6d38bf7b3082e49d07bd8b484 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

Malicious code in @hd-team/app-dnpkg-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529 The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a...

Malicious code in @hd-team/app-dnpkg-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a881d064bac4343f3b849e3b2e45fa0bb9fb8249f191f85297f53edecf08d96b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-impkg-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4a6c7bf61aa8ff219249cee5204bc5fe556e216c34afa39a5ce2685399ffbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8d3c5fba8b00e8f8ebe7868093ff8cbe2b14607b15abad8a711310868d0833e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-impkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1337f5939f8a1aab2f4e110aa41afd3b9f6cfe4501319a0ad33de48abf178cc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-ten (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39fc060cffde63f6797eaa1eb715dbfec4a108f1c8d4b54d6ed6b63072bd9d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30c16d5b694328dc82c0f6456769dae351790990437b7411f9e3a868ebf48dac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-eight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ebbb10d70e38e5772506ebd2604502a39d4c462730a4a1f2c4f21147959af9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flyteplugins-redis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-nsight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-agento11y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-echo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in hydration-ui-dlx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e76afa004355ba53a89056c6daff511bb4f41e2bd666e2a5592d033e079e5740 The package's main module contains a top-level IIFE that chmods 0o755 and detached-spawns dist/internal/math-calc.mjs, which is a Linux x8664 ELF...

Malicious code in svelte-ui-dlx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3de011fe8fbe406c62d909048d60d2619dbf85d8f8ec05079c8104d966e52a63 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tailwindcss-3d-animate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc554005eb9004f33d22597b929261d865d4bfe991d0b99d148dc25fffb7e97c index.js re-exports the legitimate tailwindcss-3d plugin and then appends evalatob"..." at module top level, so the payload runs on any...

Malicious code in tailwindcss-form-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bf4e5fbd59048a5ab6a5c04ad7c98e7246c9cf57363d95acc84f92d8ca883f4 src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style 0x string-array cipher that...

Malicious code in stackpaths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a27ce2899b65f55deaab5feaf1b3cfd2ae674a45fd3e87ab442c58d3d89ba79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in inspectstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17cc87250d7ea2211f538d56ca04d81a6653e6493beb475ea371873ddfe6a65e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in deepjoin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7191d8ad9de3616fcf3be682d6755dc092dd05df7bf8c273d1ad867a0edd6d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in charclass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8706b70b3238d5f94848a858e119e3e41d7102032d82a00ff3ae25915311d4e6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

Malicious code in sigcheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6acb99271ede5807243bea2648af5e71511853e99c473309de457a8828ac0ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in veloq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0f85e80ad1893e8546161034450eaac2165d5eb7299710f0870bc26b05b2 [email protected] is a near-verbatim fork of gulplog rebranded by 'Blockvora Team', with two injected lines inside getLogger in index.js: a call to...

Malicious code in morglog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70fd694cbd6fff160cc788117eac2e85e921870f0a2a2e24dbaf81418ed19a1 [email protected] is published under a name resembling the popular morgan HTTP logger and reuses morgan's description. The tarball ships only LICENSE,...

Malicious code in decoris (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1ce74b34855100b6ba312f767a982fb288a802da613fec375aec92665f4d9973 The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in sap-quarterly-report (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2235bdf8263c08fede094c665d2fbc4e023a0f0c5e99631d70ae0685567b37ec During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in ekx-report-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78 On import, the package runs a setup routine that reads a session credential from /tmp/.sandboxtoken and issues an authenticated GET to...

Malicious code in imo-allowlist-xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f429a987c3b4800204131b27faae0c29e55a0761a1fa2a0306ab14a343afd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

Malicious code in mathkitlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c91a8962fd66464487bcdb5e2c217990cfdea55df22e7166c11703f91dfb7845 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bnotify-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0861227aa2c7246f74708656f530b7f99a71f6e6e0be93a1ea7dc3b2d6c814d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dumb-binding-gyp-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c522e725eb8c0c66cf1c713d966b16c91947d48c6fbe50af8782537f944b6da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tset_racie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871 [email protected] ships a single 45KB obfuscator.io-style payload as its main entry index.js. The file consists of a 551-entry RC4-encrypted string...

Malicious code in shai_hulululud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f613531d1e90bc815213b8b20e3f1d9c8889cb7429fe986306747a3b7da99f49 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in the_tax_free_cashier_is_at_9f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0596e225c3ec8b9dfbd5c47b4c4c02d5f5f15c1aff917e7ab480c21936184164 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...