MAL-2026-12176 Malicious code in dateuuidv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1 The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO at requi...

Malicious code in geocode-quick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419 The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment...

MAL-2026-12224 Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

Malicious code in twork-data-services-aggregator-sme-task-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7847fa8341bf64260b2ff25824d2dbb7b80f637d77578db5604ea7ab39ea2874 On require of this package, index.js loads runtime.js which asynchronously fetches a platform-specific binary from string-concatenation-obfuscated...

MAL-2026-12303 Malicious code in twork-mf-e2e-nitro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eba320ce2333e7bd477470ded20a2be52a334069c482ab957b41772f347f63d On require of the package, index.js loads compat.js which reconstructs Cloudflare workers.dev hostnames via split-string array concatenation...

MAL-2026-12289 Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

Malicious code in twork-data-services-sme-operations-authorizations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73622aa5b1b1b3f39f914022e80a8429b948186033c2e98d5f5610e93129612 On require of the package, index.js loads compat.js which fetches a platform-specific binary from hostnames assembled by array-join to hide them from...

MAL-2026-12287 Malicious code in twork-data-services-aggregator-company-sme-main-timeline-loader-with-customers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401d167bfbb3ec350a033f908aef6678495563e92c6b090d0eaab85bd1c2b7ba On require, index.js loads bridge.js which assembles obfuscated Cloudflare Workers hostnames from split string literals...

Malicious code in twork-products-taiga2-products-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a99df0da5a899d01432bee4f862a3915efcd7b98d8334ee08347438105e79c On require of the package, index.js exports a no-op class and unconditionally loads bridge.js. bridge.js reconstructs command-and-control hostnames v...

MAL-2026-12307 Malicious code in twork-products-taiga2-products-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a99df0da5a899d01432bee4f862a3915efcd7b98d8334ee08347438105e79c On require of the package, index.js exports a no-op class and unconditionally loads bridge.js. bridge.js reconstructs command-and-control hostnames v...

Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838 index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string fragments resolving to...

Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

MAL-2026-12297 Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

MAL-2026-12292 Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

MAL-2026-12293 Malicious code in twork-data-services-invest-box-account (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce404950eecf61001f88758ef82a02523d93efe8d29c01f63521ff748b82c553 On module load, index.js requires./adapter.js which detects OS/architecture, fetches an opaque binary via https.get from string-concatenated Cloudfla...

Malicious code in a.poltoradnev-package-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a193f48dce179cc9b43bc16917f5a04d89975c3451ebd33f766545c1c168664 index.js the package main requires setup.js, which schedules bootstrap on process.nextTick, so the dropper fires on any require of the package...

MAL-2026-12127 Malicious code in a.poltoradnev-package-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a193f48dce179cc9b43bc16917f5a04d89975c3451ebd33f766545c1c168664 index.js the package main requires setup.js, which schedules bootstrap on process.nextTick, so the dropper fires on any require of the package...

Malicious code in scrollbar-hide-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f19e1731b591552a096b108703702b9663c1bbb8cf9c2ff6fc048f8582e8607 The package's main entry dist/index.js appends an obfuscated payload — wrapped in evalatob... with require targets and URLs hidden in \uXXXX escapes ...

Malicious code in cors-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5 Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin...