The npm package 'checkout-desktop-total' version 35.6.1 contains malicious code that downloads and executes a platform-specific binary from Cloudflare Workers hosts. This binary is fetched using obfuscated domain names and DNS-TXT fallback channels to evade detection. The downloaded executable is saved to disguised filenames in temporary directories and executed without user consent. The package impersonates benign tooling but performs unauthorized remote code execution upon import.
The npm package @shiftmarkets/no-brainer-sdk version 1.0.18 contains malicious code that executes a postinstall script collecting extensive host reconnaissance data, including environment variables and potential credential names. This data is sent unencrypted to a hardcoded external IP address unrelated to the vendor, without user consent. The behavior exposes sensitive environment details and credential indicators, potentially enabling follow-up attacks.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (4e6e8d8500ee41d92250882b57d98d805b381d2d08eeeac7bae55c3f5e417dff)
package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects the installer's hostname, username, home directory, DNS server configuration, current working directory, and the contents of /etc/passwd and /etc/hosts, then POSTs this payload over HTTPS to the hardcoded subdomain x75h3spwmlqq7bzriw6gm6w8azgq4hs6.oastify.com (a Burp Collaborator out-of-band interaction host). Execution is automatic at install time with no consent prompt and no documented purpose. The behavior matches a dependency-confusion reconnaissance beacon that exfiltrates installer host identity and local system files to an attacker-controlled endpoint.
## Source: ghsa-malware (a7d5d00e0c243819b3d1813314c4f4ef596f92a034d82e0a5acce92740bed5d5)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package 'pvm-autodoc' version 20.4.6 contains malicious code that downloads and executes an unverified native binary from hardcoded Cloudflare Workers subdomains or a DNS TXT fallback. This binary is saved to temporary directories with names mimicking legitimate diagnostic tools and executed without user consent. The package also includes a companion payload performing similar fetch-and-execute actions. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated immediately. Removal of the package alone does not guarantee elimination of all malicious components.
The npm package tinkoff-ui-action version 20.5.7 contains malicious code that downloads and executes platform-specific native binaries from obfuscated Cloudflare Workers subdomains and fallback domains without user consent or verification. This behavior is disguised within a React UI component library, making it unexpected and dangerous. The package writes these binaries to temporary directories, sets executable permissions, and runs them detached from the main process. A secondary payload runner is also present under an 'Analytics SDK' cover, further enabling malicious activity. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately from a separate, clean device.
CVE-2026-18733 is a prompt injection vulnerability in the shell tool of Amazon Strands Agents Tools versions before 0.8.0. This flaw allows remote attackers to execute arbitrary operating system commands on the host by crafting a prompt that sets the non_interactive parameter to true, bypassing the human consent mechanism. The issue is resolved in version 0.8.0.
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.
The @dynatrace-oss/dynatrace-mcp-server package contains a vulnerability in the create_dynatrace_notebook tool where a required human-approval gate is missing. This omission allows an unauthenticated caller to create persistent tenant-visible notebooks with arbitrary content, including embedded DQL queries that execute under the permissions of any tenant user who opens the notebook. Unlike other write tools in the package, create_dynatrace_notebook does not require operator consent before execution. This vulnerability affects versions prior to 1.8.7.
The npm package 'swiper_angular' version 5.9999.0 is identified as malicious due to embedded code that executes automatically during installation. This code collects detailed host and network information, including hostname, user info, working directory, package and git details, DNS and hosts file contents, and external IP addresses. The collected data is sent to a hardcoded external domain associated with malicious activity. The behavior targets a specific organization (tbibank) without user consent. No official patch or remediation guidance is currently available.
The npm package 'fundraiserservicepp' version 1.5.0 is identified as malicious. During installation, its preinstall script executes code that collects host system information such as hostname, platform, and architecture, then sends this data over HTTPS to a hardcoded third-party domain associated with malicious activity. The package does not provide any legitimate functionality and behaves like a dependency confusion probe, exfiltrating system identifiers without user consent.
A fraudulent website impersonating Corepack, the Node.js package manager tool, is distributing malware to developers. The attackers exploit timing around Corepack's removal from Node.js bundling, targeting developers searching for installation instructions. The site offers Windows executables that deliver OpenShield infostealer and proxyware, enrolling victim machines in bandwidth-sharing networks without consent. The payload steals browser credentials, SSH keys, establishes persistence, and routes third-party traffic through compromised systems. An alternative download path delivers adware and trojan components disguised as OperaGX installer. The site features AI-generated content with obvious errors, including confusing Yarn package manager with textile crafts. The domain has been reported to registrars for takedown after community members identified the threat.
A vulnerability in n8n versions from 2.27.0 up to but not including 2.29.8 and 2.30.x before 2.30.1 allows member-level users to execute other users' MCP Server Trigger workflows due to missing OAuth authorization checks. This flaw permits a member-level user to register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token, enabling execution of workflows in the owner's context and access to their data. The advisory is a duplicate and has been withdrawn in favor of GHSA-q5xf-xhwf-cwqf. No patch links are provided in this record.
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (0ecc4dcd6d76f100601f8b37a6b9c3aab899770ab361f2714f9193a2f8d0db78)
When the package's bin entry is run, it spawns an interactive PTY shell using $SHELL with the user's full process environment and HOME as the working directory, then opens a WebSocket connection to a hardcoded server at sheltr-server.up.railway.app. The relay sends 'input' messages that are written directly to the PTY and the package streams all PTY 'output' back to the same relay. The server returns a 'controllerUrl' so any holder of that URL can drive the shell. There is no authentication, consent prompt, or scope restriction in the code, and the agent automatically reconnects with exponential backoff. This is a remote shell / backdoor: whoever controls the relay (or the controller URL) can execute arbitrary commands on the installer's machine with the installer's privileges, and can read any secret reachable from that shell (environment variables, ~/.ssh, ~/.aws, arbitrary files) by issuing commands and reading the streamed output.
The npm package 'hehehee' version 1.0.9 contains malicious code masquerading as a Windows diagnostic and DOM utility. It stealthily injects a hardcoded ChatGPT session token into an Electron session, enabling the package author to capture all screenshots and UI-extracted text sent through ChatGPT. The package also persists on the system by copying an Electron executable to mimic a legitimate Windows system binary and respawns itself with randomized delays, evading termination. It further employs anti-proctoring techniques to avoid detection in exam environments and automatically installs missing native modules without user consent. This behavior constitutes a supply-chain attack that compromises user privacy and system integrity.
PraisonAI Agents have a vulnerability in their tool approval system where approval is cached only by tool name, not by invocation arguments. This allows subsequent shell command executions to bypass user consent prompts after a single approval. The system also passes all environment variables, including sensitive API keys, to subprocesses without filtering. This combination enables an LLM agent to exfiltrate secrets silently after one approved command. The approval cache persists for the entire agent execution without clearing or expiration. A fix is available in version 4.5.128 that enforces per-invocation approval for critical tools.
The npm package @db-tools/main-app version 2026.6.30 contains malicious code that executes a preinstall hook on every npm install. This hook sends the installer's public IP address and synthetic exception data to an author-controlled Sentry project without user consent. Additionally, the package's init() function silently sends application exceptions and personally identifiable information (PII) to the same remote Sentry project if no explicit DSN is provided, with no disclosure in the documentation.
The slds-lsp-client package was published to the npm registry by user 'click2ai' (maintainer email privatek3m@protonmail.com) as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization (a Salesforce SLDS / Lightning Design System language-server (LSP) tooling namespace) so that a misconfigured resolver installs this public lookalike instead of the intended private dependency.
The package declares a preinstall hook ("npm install @sentry/node && node examples/verify.js") that executes automatically at npm install time, before any application code runs. The bundled examples/verify.js initializes the @sentry/node client against a hardcoded, attacker-controlled Sentry DSN with sendDefaultPii enabled, resolves the installing host's public egress IP address by requesting Cloudflare's /cdn-cgi/trace endpoint (using a spoofed desktop-browser User-Agent to bypass bot challenges), then deliberately triggers a runtime exception and captures it. Flushing the event beacons the collected host telemetry (public IP plus Sentry default PII such as hostname, OS username and runtime/environment metadata) to the attacker's Sentry ingest endpoint at o4510485815754752.ingest.us.sentry.io.
Each impersonated namespace in the campaign beacons to a distinct Sentry project ID, letting the operator attribute successful installs to specific victim organizations — behaviour consistent with a dependency-confusion reconnaissance beacon rather than legitimate error monitoring. The install-time payload is byte-for-byte identical across all packages published by this account, differing only in the package name and the target DSN. This package's beacon targets Sentry project 4511716882972672.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d1a204f1615398c380936de4d1e2603cab90300e0e7bc20770ffd0bbe693ce80)
Package name presents as a Salesforce Lightning Design System / Language Server Protocol client, but the shipped code is a thin Sentry wrapper with no SLDS or LSP functionality. package.json declares a preinstall script that runs `npm install @sentry/node && node examples/verify.js`, which resolves the installer's public IP via a Cloudflare trace endpoint, attaches it as the Sentry user identity (sendDefaultPii:true), and triggers a forced exception so the event — carrying the installer's IP and host/error metadata — is uploaded on `npm install` with no consent. The Sentry DSN is hardcoded to an author-controlled project at o4510485815754752.ingest.us.sentry.io/4511716882972672 (DEFAULT_DSN in src/index.js). The exported init() also falls back to the same hardcoded DSN when a caller does not supply one, so consumers of the library additionally route their application error telemetry and default PII to the same author endpoint. The name/description mismatch combined with an install-time beacon fits an opportunistic install-time data-collection package targeting typos or misfires.
## Source: ghsa-malware (2265e2b46fde3cf1883c191549a7bd9e5d2afe8072876c632b60edc4bc9e0cd6)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package @meziizana/frontend-logger version 10.0.0 contains malicious code that executes a preinstall script during npm install. This script sends the installer's username, current working directory, and hostname to a third-party endpoint at webhook.site without user consent. The destination is a public request-inspection service commonly abused for data exfiltration, indicating unauthorized reconnaissance activity.