Threat Intelligence Database

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d) The package advertises a single function `module.exports = function hello(name)` but ships a `preinstall.js` lifecycle script that runs automatically on `npm install` and performs reconnaissance unrelated to the advertised functionality. The script collects OS username, hostname, platform/arch, and the full running process list (`ps -eo comm=` on POSIX, `tasklist /fo csv /nh` on Windows), and issues an HTTP PUT to the AWS EC2 link-local IMDSv2 token endpoint at `169.254.169.254/latest/api/token` followed by a fetch of `/latest/meta-data/instance-id`. Results are written to `./exfil.log` in the installer's working directory. The file's own header comment self-describes as a 'SECURITY DEMO payload' proving that a trojanized package gets code execution at install time. Even though the current version writes locally rather than transmitting, the recon chain (process enumeration + cloud-instance fingerprinting) has no relationship to a hello-world library, runs without consent on every install, and pollutes the consumer's CWD with an artifact. ## Source: ghsa-malware (11c60369d43860157d7d1d5e7740d89e0c0b4e759e89d162450e247e04b483a2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dc1d083feee4cace9dba5cabdfd74701c7dc093520f0bbc104858ab699203604) index.js (declared as the package main) reconstructs a host, URL paths, and dropped filenames from String.fromCharCode numeric arrays, resolving to https://filament-zap.vercel.app/service/assets/fetchBinary and /fetchLinuxBinary. On require, it downloads an OS-specific binary over HTTPS, writes it to %LOCALAPPDATA%\Programs\WinMetrics\WinService.exe on Windows or ~/.local/share/WinMetrics on Linux, chmods it 0755 on Linux, and spawns it detached with stdio ignored and windowsHide set. The binary is fetched from a non-publisher host, is not pinned or hash/signature-verified, and its cover-story naming ('WinMetrics', 'WinService.exe') is unrelated to the package's advertised input-masking purpose. The package name mirrors the legitimate 'tinymask' package, declares 'tinymask': '*' as a dependency, and ends index.js with module.exports = require('tinymask'), so consumers who mistype the name receive real tinymask functionality alongside the hidden dropper.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cbd414dae34760c2eda09d2093a62a14d694f759350676e88229319a16594e78) On require(), index.js calls callCallerAsOrigin() which spawns lib/caller.js as a detached, stdio-ignored child process (spawn(process.execPath, [script], { detached: true, stdio: 'ignore' }); child.unref()). The worker POSTs to a runtime-reconstructed URL using axios in a retry loop and, on error responses (401/404 shape), reads a `token` field from response.data and passes it to `new module.exports.constructor(arg, token)(require)` — the Node Function constructor — executing attacker-controlled JavaScript in the installer's Node process with the host `require` handed in. lib/caller.js and lib/config.js are wrapped in `Function(name, "...")({...})` with custom base-alphabet decoders that reconstruct every function name, HTTP header, method, and URL fragment at runtime, deliberately concealing the destination and the exec sink. Package metadata is a cover story: package.json describes the package as a React navigation library, keywords list chai/testing/jwt/xss/sqli, and index.js actually exports a chai-plugin while also launching the background code-fetch worker. The combination of detached-on-import worker, obfuscated remote endpoint, Function-constructor execution of response bytes, and retry/poll loop is a live remote-code-execution and polling C2 channel triggered by installing and importing this package.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1cf89f8fbe4c3f9ae9494077688977f46c8b3f875a552054508ac5eec7b62344) notify-dist advertises itself as a pino-compatible logger/middleware (exports `module.exports.pino`, keywords fast/logger/stream/json, lib/ mirrors pino internals such as proto.js, multistream.js, redaction.js, transport.js), but the exported middleware's only side effect is to launch a remote-code loader. When a consumer requires the package and invokes the exported middleware, index.js spawns `node lib/caller.js` as a detached child with `stdio: 'ignore'` and `child.unref()` so the loader survives after the parent exits. lib/caller.js issues an HTTP GET to https://jsonkeeper.com/b/BPB86 via axios, reads the `.cookie` field of the response, and executes it as JavaScript via `new Function.constructor('require', s)(require)`, giving the fetched code full Node privileges including `require`. The loader retries up to 5 times and silences console.log to hide activity. lib/const.js additionally holds base64-encoded fields that decode to a second endpoint (https://jsonkeeper.com/b/ZK45J) and header name `x-secret-key`, serving as a rotation/backup payload URL. jsonkeeper.com is a mutable third-party JSON paste host, so the executed code is fully attacker-controlled and can change at any time. The pino-shaped API surface is a lure: consumers importing this expecting logger behavior get arbitrary remote code execution on their machine.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bf143361939feffe7099c14acc7cf41a401681481e932e15d6054dde49e88f94) [email protected] is an empty shell package: `index.js` is `module.exports = {}` and `package.json` has no description or author. Its `dependencies` declares `"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.1.tgz"`, resolving a transitive dependency directly from a third-party Google Cloud Storage bucket rather than the npm registry. On `npm install`, npm fetches and installs that opaque tarball and executes any lifecycle hooks it declares on the installer's machine. The version `99.9.1` is the canonical outranking-version pattern used in dependency-confusion attacks to override a legitimate internally-named package, and the URL path literally contains the token `depenconf`. The package has no functional purpose other than smuggling this off-registry dependency into the installer's environment. ## Source: ghsa-malware (401dface4dee0f5b93603c52d947b3e856983c806dca6453edc9efef6afa482b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (751317dcad79cec866b8dc69cd60b39e3be8e1bcc45746039835b04ce32445b0) package.json declares its only dependency `ltidisafe` as a direct HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.2.tgz`) hosted on a generic Google Cloud Storage bucket rather than resolved from the npm registry. On `npm install mazemap`, npm fetches and installs that arbitrary tarball, executing any lifecycle scripts (preinstall/install/postinstall) it contains — the tarball is bucket-owner-mutable and not subject to registry vetting. The package itself is a hollow lure: `index.js` is a 35-byte `module.exports = {};`, with no description, no author, ISC default license, and version `99.9.1` — a recognized dependency-confusion technique for overriding an internal package of the same name via a higher public version. The bucket path segment is literally `depenconf`. The combination of hollow main, inflated version, anonymous GCS-hosted dependency, and name collision with a real product (MazeMap) is a dependency-confusion / smuggling shape whose only on-install effect is to pull and execute attacker-controlled code from a non-registry source. ## Source: ghsa-malware (b2544226891e60a2b6f33b0aacf3e4669fe4ce13220f01bd40a84c8657fe0518) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cadcdda902675162dd9cfabd9d8133986723d4c956437633f36a5a07b776ef59) [email protected] ships an empty stub (index.js: `module.exports = {};`) with no description, author, or repository, but declares a single dependency `ltidisafe` as a direct tarball URL: `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.6.tgz`. The bucket is on Google Cloud Storage, unrelated to any documented publisher, and the bucket/path naming (`ltidi`/`depenconf`) is consistent with a dependency-confusion staging area. URL-tarball dependencies bypass the npm registry's visibility, signature, and tooling — `npm install` will fetch the.tgz directly and execute any preinstall/install/postinstall lifecycle scripts it ships, with no hash pin, no signature, and no registry review. The wrapper contributes no functionality; its only effect on install is to smuggle the off-registry tarball into the installer's dependency tree. The high version number (99.9.1) and absent metadata are also consistent with a dependency-confusion lure intended to outrank an internal package of the same name. ## Source: ghsa-malware (618392bced7b75db7d804281a68124e3827f13da40512505dfadb7984878d722) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (783cf770777fff7cfffc2abec6cebd37f9e11f9e219c95e9879dda1222f9177c) The OpenSSF Package Analysis project identified 'firefly-utilities-helper' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a4ca306052ea5224831743daec9d3944fadff8cb4a7211e980be7669a739d00d) [email protected] is an empty wrapper package (index.js is `module.exports = {};`, empty author/description, inflated 99.9.1 version) whose sole effect on install is to pull a single dependency declared as a direct tarball URL: `"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.8.tgz"`. The bytes at that GCS bucket are mutable, unpinned, and not integrity-hashed; the bucket owner can swap the tarball at any time, and whatever code is in it executes at `npm install` time and on `require`. The wrapper has no functional content of its own, the bucket path literally contains the string `depenconf`, and the 99.9.1 version is the canonical shape of a dependency-confusion squat designed to shadow an internal package name and drop arbitrary attacker-controlled code into the installer's environment. ## Source: ghsa-malware (b949b5a457e726a907fa5e6b27ac585521202e3138218191b3bfe2945ecb39ff) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (82f07d72efb0234c99f1db77fa557334d2cf010cd0a7020e470d6e72518c0a5d) The OpenSSF Package Analysis project identified 'ltidiconf' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f73e9c228fc5188d602b213f2c6e7f88d6acbb4a9381667b7c33e4cb825aedf2) Package `[email protected]` is a dependency-confusion lure targeting the Higher Logic vendor namespace. The published `index.js` is an empty `module.exports = {}` — the package ships no functionality. Its sole dependency is declared in `package.json` as a direct tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.1.4.tgz`) rather than a registry-hosted version. On `npm install`, npm fetches that tarball from an arbitrary Google Cloud Storage bucket and executes any lifecycle scripts it contains on the installer's machine. The high version `99.9.1` is the standard dependency-confusion pattern used to override an internal private package of the same name during resolution, and the bucket path segment `depenconf` reinforces the attack intent. The installer cannot audit the fetched bytes via normal registry tooling, and the tarball contents are mutable at the bucket owner's discretion. ## Source: ghsa-malware (4ad1c3e1385f4524e8d0d34b8be29a99f4d3d80a03d8ce6196cad9e0a6cd4468) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9314c597c5023f198b20ebe47d09cf929d8e252e27f60928a3ab73dbe77de8cd) [email protected] ships an empty stub (`index.js` is `module.exports = {}`) with placeholder author/description metadata and an unusually high 99.9.1 version designed to win semver resolution against an internal package name. Its sole effect is a `dependencies` entry that pulls `ltidisafe` from an external HTTPS tarball at `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.9.3.tgz` — not from the npm registry. On `npm install`, npm fetches and installs that tarball and runs whatever lifecycle scripts and code it contains. The tarball is hosted on a third-party Google Cloud Storage bucket under a path (`depenconf/`) that explicitly suggests dependency-confusion tooling; its contents are mutable by the bucket owner, there is no integrity hash, no version pinning to a trusted registry, and no relation to any stated package purpose. This matches the canonical dependency-confusion off-registry-dropper pattern. ## Source: ghsa-malware (d4629b915cdacf2c06a56d5bb43476aef698d2e2a827d15eeb303154454b105b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (d4a2106922e9e3851658667cacaa2c2818cdb56cd0c4df6778c0cb7fbed2338e) The OpenSSF Package Analysis project identified 'page-info-service' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.