MAL-2026-17299 Malicious code in testosu8887 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9d3296b770afd3fdebaf4df9d113873e9c77d2d498d2e7941a3465eeb6f97d On require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function dispatchAnalytics, invoked via he/Re that reads a bundled ima...

MAL-2026-17298 Malicious code in testosu888 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27 On loading dist/index.cjs main entry and on running the dot2env CLI dist/cli.cjs, the package invokes a dispatchAnalytics routine that reads...

Malicious code in testosu888 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27 On loading dist/index.cjs main entry and on running the dot2env CLI dist/cli.cjs, the package invokes a dispatchAnalytics routine that reads...

MAL-2026-17293 Malicious code in @selfpentest/eslint-pentest-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f338876601180482b20a42fbd799b9d4e1b059bf7d733b5db448f7fc6d3455ff Package presents itself as an ESLint plugin but the exported plugin object is an empty shell. index.js unconditionally invokes a steal routine at top...

MAL-2026-17292 Malicious code in @selfpentest/bin-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3 package.json registers a bin entry named npm pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a...

Malicious code in @selfpentest/bin-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3 package.json registers a bin entry named npm pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a...

MAL-2026-17287 Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc8739717b3768c51a56da3a23b85b253b0bc08a2ab4a447e278d055c8a2e70 This package presents itself as a fork of the Baileys WhatsApp library. On every successful login through makeWASocket, lib/Socket/socket.js invokes...

Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc8739717b3768c51a56da3a23b85b253b0bc08a2ab4a447e278d055c8a2e70 This package presents itself as a fork of the Baileys WhatsApp library. On every successful login through makeWASocket, lib/Socket/socket.js invokes...

MAL-2026-17285 Malicious code in @akapaki/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14fdf44df68d2544cc235039ef40a99c7df7bcbfc968e8d5809762031f0dd16 @akapaki/[email protected] is an unofficial republish of the Baileys WhatsApp library under a new scope author paki, empty README, repository...

Malicious code in @akapaki/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14fdf44df68d2544cc235039ef40a99c7df7bcbfc968e8d5809762031f0dd16 @akapaki/[email protected] is an unofficial republish of the Baileys WhatsApp library under a new scope author paki, empty README, repository...

MAL-2026-17286 Malicious code in queeuees (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f793adc7f1d26294831307abed18a284d7834d8e4733a8b05d9863bf2d70c60d Queeuees 0.0.1 ships two top-level packages, Queeuees and Queues, with byte-identical init.py files. Each init.py assembles a byte blob from...

MAL-2026-17306 Malicious code in fabric-loader-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...

MAL-2026-17284 Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17283 Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17282 Malicious code in @hrmony/hyper-json-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8139053048172994cadd0251ef74e5104c489dcb4f0448153ea9342b3feb707 On module load, index.js performs top-level fetch to a hardcoded attacker-controlled endpoint at...

MAL-2026-17253 Malicious code in @hrmony/benefit-essenszuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...

Malicious code in @hrmony/account-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b699bc4a206505ba0cf224888996e37fe00dff5ffb737e3b95b9fd139b910f The main module executes on require/import via a top-level await. It queries the AWS IMDSv2 metadata service at 169.254.169.254 to retrieve instance...

MAL-2026-17251 Malicious code in @hrmony/app-gateway-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d3f05113dd7daa9fac2da8187afecc751fafcf96449e7f4eb4a5d9a4878844 On require/import of @hrmony/app-gateway-templates, index.js the package main executes an exfiltration routine against a hardcoded attacker endpoint ...