Malicious code in svelte-vli-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e69d1c24676b4273c3413856b424256c6ff7a437a48e7037156fa5f7f8911060 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15619 Malicious code in testdgdbcsd (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15605 Malicious code in m2fcsfyjkuxb (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15609 Malicious code in mn2adskhweox (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-14539 Malicious code in zenntechinc-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ab82f90e45185d5e25435ce8fc92501dbf7b7384ec6eea6e6b7416ac9426cfb The npm package ships an obfuscated payload appended to templates/backend/.eslintrc.js, after a legitimate-looking ESLint config. The payload uses...

Malicious code in octopus-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6968c2a12f60b671ee163f42c9da14ed51d9b0b29486b4a7d1bf5014b4c637f2 The package declares a preinstall lifecycle script node index.js that runs automatically on npm install. index.js collects the installer's hostname, ...

MAL-2026-14537 Malicious code in octopus-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6968c2a12f60b671ee163f42c9da14ed51d9b0b29486b4a7d1bf5014b4c637f2 The package declares a preinstall lifecycle script node index.js that runs automatically on npm install. index.js collects the installer's hostname, ...

MAL-2026-14528 Malicious code in baileys-inmemory-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610d72c934ff0795b4aceddfc341b582c27f71034a47cf3e874e21387c842d34 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14529 Malicious code in baileys-mbuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508ded2b926100712d9abf255683432d44a917c067f9d69b14b4c678918ce8bb package.json declares "postinstall": "node lib/index.js --install", and lib/index.js is a single 6.3 MB JSFuck-style eval expression that reconstruct...

Malicious code in baileys-inmemory-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610d72c934ff0795b4aceddfc341b582c27f71034a47cf3e874e21387c842d34 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in baileys-mbuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508ded2b926100712d9abf255683432d44a917c067f9d69b14b4c678918ce8bb package.json declares "postinstall": "node lib/index.js --install", and lib/index.js is a single 6.3 MB JSFuck-style eval expression that reconstruct...

MAL-2026-14526 Malicious code in omniauth-recharge-rails-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27ec72eac9d0bae686eddce65991c912a23c97621648e3316cd05188038d17d7 The package's package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL...

Malicious code in hydration-ui-cls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dab60d6a779e65d7fa94af8c036d86b722a9cfddbe12d637990251a35004356 On import, dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-eng.dat to 0755 and spawns it detached via childprocess.spawn. T...

MAL-2026-14517 Malicious code in hydration-ui-cls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dab60d6a779e65d7fa94af8c036d86b722a9cfddbe12d637990251a35004356 On import, dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-eng.dat to 0755 and spawns it detached via childprocess.spawn. T...

Malicious code in svelte-ui-cls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41593a52d2887b1bbbf1e1982cd8a12d011dfd8802605e083fdbfc86bf7ab5a8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14518 Malicious code in svelte-ui-cls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41593a52d2887b1bbbf1e1982cd8a12d011dfd8802605e083fdbfc86bf7ab5a8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in foldmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569b7cd07b2dc5be0a93c14cf8798990210cdc1210dc7dc842dab5017f69f551 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14507 Malicious code in foldmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569b7cd07b2dc5be0a93c14cf8798990210cdc1210dc7dc842dab5017f69f551 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in hexdrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f6b00b26052d34947326afc5e17df34500b077e8ed58daa9e9f67c3a93737e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14508 Malicious code in hexdrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f6b00b26052d34947326afc5e17df34500b077e8ed58daa9e9f67c3a93737e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...