MAL-2026-11388 Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

MAL-2026-11400 Malicious code in thedata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...

Malicious code in @vaultflow/update-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031c8cb2cc9eb21371fdd4a9a9d6949857fd978868e3dfd8f5d126e95a6a5780 index.js is a verbatim copy of the feross/buffer module with a single injected top-level statement var ins = import'@vaultflow/create-flow' that...

MAL-2026-11087 Malicious code in kalipto-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...

MAL-2026-11089 Malicious code in txs-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c934ab0c25791138fe4673ea55529933cc40e3aab0f03a660820712181cd20d No concrete installer-harm signals were identified in this version. Package name suggests transaction-building functionality, but without verified...

MAL-2026-11086 Malicious code in fazzgram (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8799da09b9c2cf933d99463789c230da7d238000ba0fde0b311a4050353a6ead fazzgram is a Telegram Bot API wrapper. Supporting modules ApiClient.js, Dispatcher.js, LongPoller.js, WebhookServer.js, Context.js, Markup.js are...

Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11019 Malicious code in veskr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05d4b49dfdad9ef3eb4605e61998fab98f41bb282c48020b91492ea25f0c0d97 No a static rule matches and no traced code behavior indicating exfiltration, install-time remote code execution, silent relay, credential...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

MAL-2026-10836 Malicious code in @gocortexio/npmgremlinbox-malware-install-execution (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a5a537b1738692165e905b11697bdac7455cccde5bf8b788767642d26c33b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10821 Malicious code in @gocortexio/npmgremlinbox-eupl-1-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fadc3dc1481610f965f36f4aa49e3cefcae48ce40e0ec2c4f98ef63f62bf00b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10569 Malicious code in temp-cloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec75c040be8d9901d8715cc65309341f95b497d35062ea6014b7e4a36b35ff89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sixseven10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21936e53270838d4901646de1e1c3eef9212055032d3cead428cbf3bfd60b9ed The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

MAL-2026-10386 Malicious code in testdonotredeemit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9f9461b13f64b90e569dcc6354708559128c23f4e47e4ac5842b46ce0fb6ed2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ishowfeet20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57470f610cd7e988daef50a3a2587778f3dce2cb1584572d4a1795876f9cf6fe The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49cfb64273573166bc38b5ef83b722b3a264c8e19870fc65b35eaaa5504a69bf The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in sixseven3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c8f4197e26649b629a6605099f9ca45ff63f04e58e5021a0f1ed410ac56cfd1 The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

Malicious code in howmanygreatbritain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66707a972e4b6d232236d552157967ca09de229587cb90ca80ab1a1cac83fd22 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in backup2-asd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6fe96add7d70ce5933988f1c78b934187e279d88618bd3f211de3d719177168 The tarball published as [email protected] is a Vite-built browser application branded 'Lucide' rather than a Node library. package.json declares mai...