Event Triggered Execution
Malware relies on package lifecycle events, hooks, or other trigger points to execute or maintain access.
discovered 2025-01-16
Seen in packages
- npmchrome-api-utilsuses
- npmgrafana-sentry-datasourceuses
- npm@patternfly-v5/patternflyuses
- npmelectron-builder-13uses
- npmgraphql.vscode-graphql-syntaxuses
- npmmattermost-cloudnative-bootstrapperuses
- npmeslint-config-prettieruses
- npmeslint-plugin-prettieruses
- npmsnyckituses
- npm@pkgr/coreuses
- npmnapi-postinstalluses
- pypibitensoruses
- pypibittenso-cliuses
- pypiqbittensoruses
- pypibittensouses
- npmnxuses
- npm@nx/jsuses
- npm@ctrl/tinycoloruses
- npmhyatt-residential-rosteruses
- npmhyatt-albumuses
- npmhyatt-avataruses
- npm@zapier/zapier-sdkuses
- npm@asyncapi/specsuses
- npm@quick-start-soft/quick-markdown-printuses
- npm@quick-start-soft/quick-markdownuses
- npm@quick-start-soft/quick-remove-image-backgrounduses
- npm@quick-start-soft/quick-git-clean-markdownuses
- npm@quick-start-soft/quick-document-translatoruses
- npm@quick-start-soft/quick-markdown-imageuses
- npm@quick-start-soft/quick-task-refineuses
- npm@asyncapi/modelinauses
- npmposthog-react-nativeuses
- npmposthog-nodeuses
- npm@postman/secret-scanner-wasmuses
- npm@postman/csv-parseuses
- npm@postman/node-keytaruses
- npm@postman/tunnel-agentuses
- npm@postman/wdio-allure-reporteruses
- npm@postman/postman-mcp-cliuses
- npm@postman/mcp-ui-clientuses
- npm@postman/wdio-junit-reporteruses
- npm@postman/pm-bin-macos-arm64uses
- npm@postman/pm-bin-linux-x64uses
- npm@postman/aether-iconsuses
- npm@Schedaero/shareduses
- pypilitellmuses
- npmoc-aa-module-clientuses
- npm@wame/ngx-adfsuses
- npm@the-coca-cola-company/ngps-global-common-utilsuses
- npmcr-static-shared-componentsuses
- npm@ceeferenderer/fe-renderer-sdkuses
- npmaxiosuses
- npmmgcuses
- npmstrapi-plugin-cronuses
- npmstrapi-plugin-configuses
- npmstrapi-plugin-serveruses
- npmstrapi-plugin-databaseuses
- npmstrapi-plugin-coreuses
- npmstrapi-plugin-hooksuses
- npmstrapi-plugin-monitoruses
- npmstrapi-plugin-eventsuses
- npmstrapi-plugin-loggeruses
- npmstrapi-plugin-healthuses
- npmstrapi-plugin-syncuses
- npmstrapi-plugin-seeduses
- npmstrapi-plugin-localeuses
- npmstrapi-plugin-formuses
- npmstrapi-plugin-notifyuses
- npmstrapi-plugin-apiuses
- npmstrapi-plugin-sitemap-genuses
- npmstrapi-plugin-nordica-toolsuses
- npmstrapi-plugin-nordica-syncuses
- npmstrapi-plugin-nordica-cmsuses
- npmstrapi-plugin-nordica-apiuses
- npmstrapi-plugin-nordica-reconuses
- npmstrapi-plugin-nordica-stageuses
- npmstrapi-plugin-nordica-vhostuses
- npmstrapi-plugin-nordica-deepuses
- npmstrapi-plugin-nordica-liteuses
- npmstrapi-plugin-nordicauses
- npmstrapi-plugin-finsevenuses
- npmstrapi-plugin-hextestuses
- npmstrapi-plugin-cms-toolsuses
- npmstrapi-plugin-content-syncuses
- npmstrapi-plugin-debug-toolsuses
- npmstrapi-plugin-health-checkuses
- npmstrapi-plugin-guardarian-extuses
- npmstrapi-plugin-advanced-uuiduses
- npmstrapi-plugin-blurhashuses
- npm@velora-dex/sdkuses
- npmsjs-bigintegeruses
- npmsjs-lint-build1uses
- npmbjs-bigintegeruses
- npmbjs-lint-builderuses
- npmbjs-lint-buildersuses
- npmcjs-bigintegeruses
- npmts-lint-buildsuses
- npm@genoma-ui/componentsuses
- npmrrweb-v1uses
- npm@needl-ai/commonuses
- npmdom-utils-liteuses
- npmcentraloggeruses
- npmforge-jsxuses
- npm@johntaohunter/forge-jsxuses
- npmjs-logger-packuses
- npmixpresso-coreuses
- npmgodsplanuses
- npmeyevoxuses
- npmnpm-global-utiluses
- npmexioussuses
- npmnode-env-resolveuses
- npmmartinez-polygon-clipping-tonyuses
- npmnoon-contractsuses
- npmiceberg-javascriptuses
- npmsupabase-javascriptuses
- npmauth-javascriptuses
- npmmicrosoft-applicationinsights-commonuses
- npmms-graph-typesuses
- npmnode-ipcuses
- npm@antv/async-hookuses
- npm@antv/dipper-hooksuses
- npm@antv/xflow-hookuses
- npmpolymarket-trading-cliuses
- npmpolymarket-terminaluses
- npmpolymarket-tradeuses
- npmpolymarket-auto-tradeuses
- npmpolymarket-copy-tradinguses
- npmpolymarket-botuses
- npmpolymarket-claude-codeuses
- npmpolymarket-ai-agentuses
- npmpolymarket-traderuses
Campaigns
- Enterprise Dependency Confusionattributed-to
- eslint-config-prettier Compromiseattributed-to
- Bittensor Typosquat Campaignattributed-to
- s1ngularity nx Build System Compromiseattributed-to
- Shai-Huludattributed-to
- TeamPCPattributed-to
- No Specific Campaignattributed-to
- Strapi Plugin C2 Campaignattributed-to
- big.js Typosquat SSH Backdoorattributed-to
- tanvisoul9 npm Backdoorsattributed-to
- fucktestpad npm Malwareattributed-to
- Claude Code Hook Backdoorsattributed-to
- Mini Shai-Huludattributed-to
- Crypto Wallet Drainersattributed-to
