239548 matches found
MAL-2026-14169 Malicious code in comand (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux,...
MAL-2026-14180 Malicious code in lodahs-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...
MAL-2026-14167 Malicious code in chalk-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...
MAL-2026-14168 Malicious code in chalk-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4 [email protected] is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm...
MAL-2026-14182 Malicious code in lodash-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm...
MAL-2026-14165 Malicious code in chalk-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf1ccbcd9b3ae6643a7948154a981ef7e072afbae6d9611f832df11fccc6707 [email protected] typosquats the popular chalk package but ships no chalk functionality — index.js exports an empty object. Its only behavior is in...
MAL-2026-14188 Malicious code in sui-move-gql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53 On require of the package, lib/diagnostics.js reads /.sui/sui.keystore, files under /.sui/suiconfig/, /.aws/credentials, and /.aws/config from the...
MAL-2026-14166 Malicious code in chalk-es (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js. On install the script XOR-decodes...
MAL-2026-14173 Malicious code in commandor-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab The postinstall script in [email protected] scripts/postinstall.js contains XOR-obfuscated byte arrays that decode at runtime unpackSegment with k...
MAL-2026-14159 Malicious code in @evial/runtime-health (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59022bd399abaafea3b730e96ba9cc0252dbf18266f6f14200e0b1b6f1feba6f The package's package.json declares postinstall: node -e "require'./scripts/lodash.js'" and sets the same file as main, so the payload runs both on n...
MAL-2026-14172 Malicious code in commandor-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75d139bce34f1d3290c34bb6da1c421bb579afb93672b44909ed0725eb70be3c The postinstall script in [email protected] scripts/postinstall.js XOR-decodes a hardcoded URL using key 'stf2026' that resolves to...
MAL-2026-14171 Malicious code in comander-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19734d8bfb929b0c1049b6220271fabaa91603506cdcb6424e67988519da9a6e [email protected] is a typosquat of commander with an empty index.js and no native sources. Its scripts/postinstall.js runs automatically on npm...
MAL-2026-14176 Malicious code in dev-env-check (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...
MAL-2026-14163 Malicious code in axois-http (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885 axois-http is a typosquat of axios index.js exports an empty object. Its scripts/postinstall.js unconditionally POSTs a JSON body containing a...
MAL-2026-14179 Malicious code in loadashjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f2ee2a45d09f0e66b8c9c6c4b3f2d19d39af009f71abffba1032b185fc4981 loadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically ...
MAL-2026-14178 Malicious code in ladash-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js,...
MAL-2026-14174 Malicious code in commandorjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b [email protected] is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js,...
MAL-2026-14164 Malicious code in bqq1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8709cb6f826b8ee95c1d8aef1bb12c769c165260483b6a95be782af9dbeb2ba The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On...
MAL-2026-14186 Malicious code in pump-segments-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838470d6049e677964786698e4a7a5dca5897ce2623d54a4c3e84510381e74e5 package.json declares a postinstall hook that runs index.js on install. The script collects the installer's hostname, full process.env, platform info...
MAL-2026-14170 Malicious code in comander-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626 comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All...
MAL-2026-14162 Malicious code in axious-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25 axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte...
MAL-2026-14181 Malicious code in lodahsjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318 Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it...
MAL-2026-14185 Malicious code in mutex-thread (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097 The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes...
MAL-2026-14160 Malicious code in @library-dev-team/data-sanitizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec70432fa5463156a41cb4031ccdd89aa76b724eaac0c6e8e61949cb18403d02 The package's main entrypoint runs an unconditional IIFE at require time that reads .env from the current working directory and extracts values label...
MAL-2026-14177 Malicious code in fast-glob-fast (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408 fast-glob-fast is a name-squat of the popular fast-glob package its repository field even points at mrmlnc/fast-glob. The declared postinstall hook...
MAL-2026-14142 Malicious code in testingsmthb1g (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04fa6b8b5826315448e5d4f27036ab31ef115621027c040897e200894c43dfa3 scripts/postinstall.js runs at npm install and performs an install-time dropper chain. A URL stored as an integer array is XOR-decoded key 'stf2026' ...
MAL-2026-14141 Malicious code in test-npm-snurkeburk-hackerone (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0397c2435e4a2a4b33ec6cc8e396eacfa099aea042b3da6e70d96d86ea53a460 The package's preinstall lifecycle hook runs node index.js, which shells out to collect installer host identifiers hostname, cwd, whoami and the...
MAL-2026-14157 Malicious code in typscript-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945 typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte...
MAL-2026-14156 Malicious code in typscript-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1425e6f0bb2305eeddecaab5403e09ead0e8f60b9b1f817581a343cb5a3dd062 typscript-cli is a typosquat of 'typescript' index.js exports an empty object; no library functionality. Its scripts/postinstall.js is the only...
MAL-2026-14154 Malicious code in typesript-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac32bb6c3db806740bda125cf58a8f348256baa021b0a6c7b901ebb86720505 Package name is a one-character typosquat of the widely-used 'typescript' family. On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a...
MAL-2026-14155 Malicious code in typesript-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b6f2a112a6a6d3b065b205c4cbb1d8183340054a2d57d7697360e30dbdccd9 [email protected] is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is...
MAL-2026-14153 Malicious code in typescrit-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adcb90c6a48b3b20928967d1aea32cde54035ed455c474a6db4fab148b424b53 On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a hidden URL that resolves to an unrelated personal GitHub account...
MAL-2026-14152 Malicious code in typescriptt-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b701541fd1cac460b8ab9a3e24dd1d0e476965e4d247826f5108e4a8eb6996d8 typescriptt-core is a typosquat of the TypeScript ecosystem double-t with an empty main module.exports = and no library functionality. The only code...
MAL-2026-14149 Malicious code in typescirpt-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef20a464d9f616eecfd6457a02895da80d1fabf558ef49de83dca18046551e90 Package name 'typescirpt-core' typosquats 'typescript'. scripts/postinstall.js runs automatically on npm install and posts a JSON platform beacon to ...
MAL-2026-14150 Malicious code in typescrip-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44399cd197dfa6f24adf7c96a380d2e0c95a4123d8c14932ceb0a85e32ebc9b9 Package name 'typescrip-cli' typosquats 'typescript-cli'; index.js exports an empty object and the package has no library functionality...
MAL-2026-14148 Malicious code in typescirpt-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09d82fa51e42e6766fe0819517e9fb5be633702a0e22cb4da05d8920cb413c53 The package's postinstall script scripts/postinstall.js XOR-decodes obfuscated byte arrays using the key 'stf2026' to reconstruct a download URL and ...
MAL-2026-14151 Malicious code in typescriptt-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 023f754538f603fbb5379ee8be82cb9524f710495e5dddc4e631e5aafbf323b5 typescriptt-cli is a typosquat of typescript-cli whose index.js is an empty module; its only real behavior is in scripts/postinstall.js. On npm...
MAL-2026-14144 Malicious code in tyepescript-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ba91f9b227b017ddbfa6a908a0a8f0263292a0af2c11aeef0ccd24b2894862 Package name 'tyepescript-core' is a typosquat of 'typescript'; the module itself exports an empty stub. scripts/postinstall.js XOR-decodes byte arra...
MAL-2026-14145 Malicious code in typecript-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03604fc37a8607bf5c14f409dc9d13308bff3e7ec145de955ae13a07c13da92e [email protected] is a typosquat of 'typescript' whose scripts/postinstall.js performs an install-time dropper attack. Payload strings are stored a...
MAL-2026-14147 Malicious code in typescipt-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b97af3a328b837904c7860b7acbae33bea28afb53949905868867905c14be6 Package name typosquats typescript. The postinstall script scripts/postinstall.js XOR-decodes a download URL and a PowerShell launcher using key...
MAL-2026-14146 Malicious code in typescipt-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b080f58ace02e860729134afd887943345248628e5c201a5fd2e46c71f439d29 Package name typosquats 'typescript'. scripts/postinstall.js runs at npm install time and: 1 POSTs a JSON body with the installer's platform label to...
MAL-2026-14143 Malicious code in tyepescript-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a867a5fc578cb6dcb759370e837d1a4c7e24f6db63c0c0f781e2c24995905e6 tyepescript-cli is a typosquat of typescript. Its scripts/postinstall.js XOR-decodes key stf2026 a set of obfuscated byte arrays that resolve to an...
MAL-2026-14135 Malicious code in @mohamed_nowisar/token3-check (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457 The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the...
MAL-2026-14134 Malicious code in @mohamed_nowisar/depconf-canary-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078a8dc3351eb44ee9ff0d5992b9082b726d7fbce0152ae2d44595a9e279ef82 On npm install, the package's preinstall hook runs node beacon.js, which collects host identity os.hostname, os.userInfo.username, process.cwd,...
MAL-2026-14136 Malicious code in agora402-payment-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...
MAL-2026-14137 Malicious code in mtslink-depconf-probe-profileusername (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f679922753b7a59c59af851ae74275b5d4760b13fc516bc8c68e8e9568393dc6 Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.c...
MAL-2026-14138 Malicious code in optimizely-starter-kit-for-fastly-compute (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...
MAL-2026-14139 Malicious code in prism-registry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6570c9056bf020fdada0366045c4e91a0f5cb21171fe27df9fcea82259e7809 The package declares preinstall: "node index.js", which fires automatically on npm install. index.js collects host identifiers os.hostname,...
MAL-2026-14158 Malicious code in deepface-weight (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...
MAL-2026-14140 Malicious code in vite-svg-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f The package's exported getPlugin/setPlugin functions decode two base64 constants svgValidateKey, svgValidatePattern at runtime. svgValidateKey decode...