Malicious code in chameleon-src (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 170070f9183f8660c8ab51246ab146d6f03af25dcb6fb027ca73624619d098bc The package's preinstall lifecycle runs examples/verify.js, which invokes init defaulting to a hardcoded Sentry DSN...

Malicious code in tfjs-custom-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c50d87a4593cb5a0444f2333f368180b64dfb5d3b8f37e0baf4f6d686ea2ef74 tfjs-custom-module is a typosquat of the tensorflow/tfjs package. Its package.json declares a postinstall lifecycle script that runs automatically on...

Malicious code in txs-lib-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5 The package's advertised getTransactions API invokes an internal loader that reads database.js — a file disguised as a product catalog — extracts eac...

Malicious code in tailwind-custom-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720 The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an...

Malicious code in twapfetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c319f6606c9407d69fa80de43ddc3b133cba284d9356a27cc12d37b3de036b3f [email protected] ships a postinstall script scripts/install-check.cjs that, on npm install, resolves a tarball URL from environment variables...

Malicious code in system-performance-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook node install.js that opens a TC...

Malicious code in txs-runner-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9d5d94b7f75bbe8bca33eb382bfb986e68b7f0307cad7e9626da103192f254 The package advertises itself as generating random transaction data, but its main API method getTransactions invokes loadtransactiondata, which reads...

Malicious code in ts-rand-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f3c43a89866228b5365b9e318da3ea953bb2c5b7da94136d887359e8e1f07a8 Package presents itself as a random transactions SDK exposing a single API, getTransactionscount. Following that documented usage triggers a hidden...

Malicious code in tfjs-inference (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52ebb387c7f1f9bb3e96df6f8006cabc9141ddd1da35a58bfc14b42f2f6864eb The package name typosquats TensorFlow.js and its npm postinstall lifecycle script collects installer host identifiers hostname, platform, arch,...

Malicious code in test_payload_folder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf The package exposes a startVoiceJoinerconfig API that accepts a caller-supplied Discord USERTOKEN and optional USERTOKEN2 ostensibly for gateway logi...

Malicious code in lodhash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73ad64f6c3a93b504c64c10175e325463652fafd741c36cfad433bed93f24cc8 lodhash-cli is a lodash-typosquat whose main entry index.js exports an empty object; the package's only behavior is a postinstall dropper...

Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69a832d2eb4042899a17a745bac70590844ba320f3e181580314687c664e5159 The package's package.json declares a preinstall script that runs index.js automatically on npm install. index.js shells out via childprocess.exec to...

Malicious code in tailwind-utility-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to...

Malicious code in tailwind-extension-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7048fbbdab179b32cf7705e06d396bc0fb6a04df45872a6119324a545d8d03db Package is presented as a Tailwind CSS utility, but its default export getPlugin fetches JSON from a hardcoded bare-IP endpoint...

Malicious code in core-js-gns (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631 The package's postinstall hook package.json → node init.js runs an installer-side dropper. init.js gates on developer-machine heuristics presence of...

Malicious code in raectjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75a611c33224c779330b8d5313702dc44f20d197dd96f62fb236982281b9d09 scripts/postinstall.js runs on npm install and performs two attacker-beneficial actions. First, it POSTs a JSON platform snapshot to the hardcoded...

Malicious code in lodsh-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273 lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it...

Malicious code in comand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux,...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

Malicious code in chalk-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4 [email protected] is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm...

Malicious code in lodash-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm...

Malicious code in chalk-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf1ccbcd9b3ae6643a7948154a981ef7e072afbae6d9611f832df11fccc6707 [email protected] typosquats the popular chalk package but ships no chalk functionality — index.js exports an empty object. Its only behavior is in...

Malicious code in sui-move-gql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53 On require of the package, lib/diagnostics.js reads /.sui/sui.keystore, files under /.sui/suiconfig/, /.aws/credentials, and /.aws/config from the...

Malicious code in chalk-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js. On install the script XOR-decodes...

Malicious code in commandor-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab The postinstall script in [email protected] scripts/postinstall.js contains XOR-obfuscated byte arrays that decode at runtime unpackSegment with k...

Malicious code in @evial/runtime-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59022bd399abaafea3b730e96ba9cc0252dbf18266f6f14200e0b1b6f1feba6f The package's package.json declares postinstall: node -e "require'./scripts/lodash.js'" and sets the same file as main, so the payload runs both on n...

Malicious code in commandor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75d139bce34f1d3290c34bb6da1c421bb579afb93672b44909ed0725eb70be3c The postinstall script in [email protected] scripts/postinstall.js XOR-decodes a hardcoded URL using key 'stf2026' that resolves to...

Malicious code in comander-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19734d8bfb929b0c1049b6220271fabaa91603506cdcb6424e67988519da9a6e [email protected] is a typosquat of commander with an empty index.js and no native sources. Its scripts/postinstall.js runs automatically on npm...

Malicious code in dev-env-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...

Malicious code in axois-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885 axois-http is a typosquat of axios index.js exports an empty object. Its scripts/postinstall.js unconditionally POSTs a JSON body containing a...

Malicious code in loadashjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f2ee2a45d09f0e66b8c9c6c4b3f2d19d39af009f71abffba1032b185fc4981 loadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically ...

Malicious code in ladash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js,...

Malicious code in commandorjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b [email protected] is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js,...

Malicious code in bqq1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8709cb6f826b8ee95c1d8aef1bb12c769c165260483b6a95be782af9dbeb2ba The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On...

Malicious code in pump-segments-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838470d6049e677964786698e4a7a5dca5897ce2623d54a4c3e84510381e74e5 package.json declares a postinstall hook that runs index.js on install. The script collects the installer's hostname, full process.env, platform info...

Malicious code in comander-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626 comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All...

Malicious code in axious-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25 axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte...

Malicious code in lodahsjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318 Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it...

Malicious code in mutex-thread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097 The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes...

Malicious code in @library-dev-team/data-sanitizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec70432fa5463156a41cb4031ccdd89aa76b724eaac0c6e8e61949cb18403d02 The package's main entrypoint runs an unconditional IIFE at require time that reads .env from the current working directory and extracts values label...

Malicious code in fast-glob-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408 fast-glob-fast is a name-squat of the popular fast-glob package its repository field even points at mrmlnc/fast-glob. The declared postinstall hook...

Malicious code in testingsmthb1g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04fa6b8b5826315448e5d4f27036ab31ef115621027c040897e200894c43dfa3 scripts/postinstall.js runs at npm install and performs an install-time dropper chain. A URL stored as an integer array is XOR-decoded key 'stf2026' ...

Malicious code in test-npm-snurkeburk-hackerone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0397c2435e4a2a4b33ec6cc8e396eacfa099aea042b3da6e70d96d86ea53a460 The package's preinstall lifecycle hook runs node index.js, which shells out to collect installer host identifiers hostname, cwd, whoami and the...

Malicious code in typscript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945 typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte...

Malicious code in typscript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1425e6f0bb2305eeddecaab5403e09ead0e8f60b9b1f817581a343cb5a3dd062 typscript-cli is a typosquat of 'typescript' index.js exports an empty object; no library functionality. Its scripts/postinstall.js is the only...

Malicious code in typesript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac32bb6c3db806740bda125cf58a8f348256baa021b0a6c7b901ebb86720505 Package name is a one-character typosquat of the widely-used 'typescript' family. On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a...

Malicious code in typesript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b6f2a112a6a6d3b065b205c4cbb1d8183340054a2d57d7697360e30dbdccd9 [email protected] is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is...

Malicious code in typescrit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adcb90c6a48b3b20928967d1aea32cde54035ed455c474a6db4fab148b424b53 On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a hidden URL that resolves to an unrelated personal GitHub account...

Malicious code in typescriptt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b701541fd1cac460b8ab9a3e24dd1d0e476965e4d247826f5108e4a8eb6996d8 typescriptt-core is a typosquat of the TypeScript ecosystem double-t with an empty main module.exports = and no library functionality. The only code...