CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...

Malicious code in nibra1 (npm)

Source: amazon-inspector 4521ad8bc5159d00d7ab74f0911028637749bd2a7a346e8f134ad78ef8630aee The package's CLI entry index.js launches a Python payload pointer.py that registers global keyboard hooks, polls the clipboard, captures screenshots mss / PIL.ImageGrab, and walks UI-Automation trees to...

Malicious code in nodeberlin (npm)

Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded JPEG image data to a hardcoded author-controlled endpoint ...

Malicious code in gfff5 (npm)

Source: amazon-inspector 2f12f82dc8c54282b428617c03537a54f3361841b02233b6626eae6f1e8ec4ee gfff5 advertises itself as a 'System binary configuration tool' but its actual behavior is covert surveillance. When the CLI is invoked, index.js silently installs Python 3.12 on Windows via winget, or by...

Malicious code in gfff5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f12f82dc8c54282b428617c03537a54f3361841b02233b6626eae6f1e8ec4ee gfff5 advertises itself as a 'System binary configuration tool' but its actual behavior is covert surveillance. When the CLI is invoked, index.js...

MAL-2026-14296 Malicious code in gfff5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f12f82dc8c54282b428617c03537a54f3361841b02233b6626eae6f1e8ec4ee gfff5 advertises itself as a 'System binary configuration tool' but its actual behavior is covert surveillance. When the CLI is invoked, index.js...

Malicious code in nibra1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4521ad8bc5159d00d7ab74f0911028637749bd2a7a346e8f134ad78ef8630aee The package's CLI entry index.js launches a Python payload pointer.py that registers global keyboard hooks, polls the clipboard, captures screenshots...

Malicious code in nodealpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e The package installs a global keyboard hook keyboard.addhotkey on ctrl+c, polls the system clipboard every 300ms via pyperclip.paste, and captures...

MAL-2026-14270 Malicious code in nodealpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e The package installs a global keyboard hook keyboard.addhotkey on ctrl+c, polls the system clipboard every 300ms via pyperclip.paste, and captures...

Malicious code in nodeberlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...

MAL-2026-14271 Malicious code in nodeberlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...

Malicious code in saaa9 (npm)

Source: amazon-inspector 3011e5a125f4db4febea1bf6778ed69ebb11009d2a1b119a46118822f3ef6e93 The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.js spawns wscript.exe against the bundled starttool.vbs,...

Malicious code in saaa9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3011e5a125f4db4febea1bf6778ed69ebb11009d2a1b119a46118822f3ef6e93 The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.j...

MAL-2026-14254 Malicious code in saaa9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3011e5a125f4db4febea1bf6778ed69ebb11009d2a1b119a46118822f3ef6e93 The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.j...

MAL-2026-14215 Malicious code in sysdo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33 The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers globa...

Malicious code in syjoy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529 The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload pointer.py that harvests user data across...

MAL-2026-14213 Malicious code in syjoy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529 The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload pointer.py that harvests user data across...

Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

MAL-2026-14212 Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

Malicious code in bqq1 (npm)

Source: amazon-inspector c8709cb6f826b8ee95c1d8aef1bb12c769c165260483b6a95be782af9dbeb2ba The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On require/start, index.js unconditionally executes startApp, which...