Malicious code in @ppa-web-components/ppa-banner (npm)

Source: amazon-inspector bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d @ppa-web-components/[email protected] is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and beacon.cjs. beacon.cjs defines BEACON =...

MAL-2026-18272 Malicious code in @ppa-web-components/ppa-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d @ppa-web-components/[email protected] is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and...

Malicious code in @ppa-web-components/ppa-banner (npm)

@ppa-web-components/ppa-banner is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.1, 2.0.0, 1.1.0, 0.0.1, 2.0.1, 1.0.0 has a postinstall scri...