MAL-2026-13446 Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...

Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...

Malicious code in @avi892nash/aegis-grid-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00 The package's default bin action starts an HTTP server grid.mjs that listens on GRIDRUNNERPORT default 7719. Incoming requests carry a base64-JSON...

MAL-2026-13429 Malicious code in @avi892nash/aegis-grid-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00 The package's default bin action starts an HTTP server grid.mjs that listens on GRIDRUNNERPORT default 7719. Incoming requests carry a base64-JSON...

MAL-2026-13377 Malicious code in ezdiscordbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a715452291e1bd779802f51dc90eca91740307e0bee7b9e2ca94f6f863f6a921 package.json declares a postinstall script sudo node install.js that runs install.js with root privileges on the installer's machine. Both install.js...

Malicious code in @stageflight-testbed/a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36 index.ts defines an exported telemetry function that 1 POSTs process.env and process.env.NODEAUTHTOKEN to a base64-hidden endpoint decoding to...

MAL-2026-13365 Malicious code in @stageflight-testbed/a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36 index.ts defines an exported telemetry function that 1 POSTs process.env and process.env.NODEAUTHTOKEN to a base64-hidden endpoint decoding to...

MAL-2026-13354 Malicious code in web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1f0dfc7ad97140ef740758424cd859d9c25ee55a6d6346859cebaf1e64cdce9 web3-utils-crypto impersonates the web3-utils library package description: 'Drop-in replacement for web3-utils' and ships stub wallet APIs including...

MAL-2026-13230 Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

Malicious code in bigops-status-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts...

Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

MAL-2026-13215 Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

Malicious code in dolyame-boxy-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4340fab762980b85544094ef1795fd82968bb58c7fe0f17a00f50b2df89b29d5 On require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and...

MAL-2026-13332 Malicious code in dolyame-boxy-independent-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d558b476b362ab912d18912a13c79e326b5fcdcdbe73b0f292d94aa89ac732d On require of the package, index.js loads runtime.js, which assembles Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb The package's main entry index.js requires./compat, which at import time downloads a platform-specific executable from author-controlled endpoints...

Malicious code in dolyame-ui-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9 On require of the package, index.js loads shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded...

Malicious code in dolyame-ui-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1110e4e32da50573666c0e5f281db639994fad22ed178e2039b9689cc350c284 The package advertises itself as a zero-dependency React calendar component library, but on require of index.js it loads shim.js, which selects a...