MAL-2026-10242 Malicious code in @gt-test-exp/profiler-exp-00000005 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a719b12b0a3a236ece513374dd46b73a69a18f73c26e074b1fd13d5ca4d6da1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in authvaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c707d53e30a333f8b8cf03ac2480eee3e2fa9c3c3164b1a100d333c91f9f3a On require of authvaultx main: auth.js, which loads lib/writer.js, top-level code attempts to load the separately published npm package...

Malicious code in marked-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bfc3b729c08e0882fe0f653f436c2b7e1fdae0379748c12e0f9266f6c69c963 The postinstall script scripts/install-check.cjs fetches a JSON config from https://trabalhos-flax.vercel.app/config/clob-math.json read from...

Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

MAL-2026-6946 Malicious code in @whs4/whs4_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c81447f382f370870e9dccf39168ae4d5b8105b5a94f04c7b541bbcc43598f99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in whs4_pnm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47d72187d8b59a9a40cb8397d064bc7319b20e19ee7d48b870432bd96952b089 The package declares a postinstall script node index.js that runs unconditionally on npm install. The script POSTs the absolute filename path which...

Malicious code in polytrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bb6b9a4e70c868e150f06160b187915bcdeb6c9c8f95095af4766dde92f96c5 [email protected] advertises itself as a Polymarket API SDK, but the exported getPlugin function in index.js issues an HTTP request to...

Malicious code in crypto-base58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7da752b2532b67e824f8904ffce7618b074a6a58746099b36b4ee547d936c8d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6922 Malicious code in mcp-server-pg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d68bdfced357622e33e4608bd35ded4d8988ea6dc7da073b3a83075978815d On npm install, scripts/postinstall.js unconditionally reads a range of installer-owned identity and configuration files and POSTs a JSON payload to ...

Malicious code in xnder-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aeeac149a5afa4797eea935b2a54b66fcf2cfd939fce855655208245ba9e5a7 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation of th...

MAL-2026-6898 Malicious code in ts-relayer-pub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a8ec05f673f1d04b65918474a638737320ac81126814fd8be765bbdc2bb5c1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in syncora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad6a402b2081c7bd35f082e81588979985d9e4b458e0a34794e50f4acc14fd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6875 Malicious code in secure-box (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fac79042697157915144f205c342b79f8a019218c45580224a85c045c03fea9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in safe-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7501c4aac0734efb1103573bfcd7e85fa6bb251510656c94bc9ceb747c009d2 The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires lib/schema/bootstrap.js a...

MAL-2026-6870 Malicious code in react-svg-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dfd17f5adea1f08d99a1ef6b9cbc94e51b0fa5b67f2fa1971119acf10e3eece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6861 Malicious code in picocolor-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d3e751383a2838104b1052c4c7fd53fbbaa7205213e84939304080212ea64b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6840 Malicious code in js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e9d44c332336a14caee5760aaa5452348e99ccefb9c853091186194c1378a68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6808 Malicious code in chain-await-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77e7f01c553ac23e33093f616c3643869064c384e748db9a383cdcf854a07976 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6797 Malicious code in mongoose-lean-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 540ace1cb8bc936ea953554a9ffc28203370f82cb5e5a7dfbf1454bf0e834b9a On require'mongoose-lean-hooks', the package's main entry index.js runs a top-level async IIFE that issues an HTTP GET to...

Malicious code in zredis-typed (npm)

zredis-typed is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign Wave 4. It was published by npm account 'donimique' [email protected]. The package.json description 'Node.js integration layer for Autodesk Forge' and the bundled README.md literally...