MAL-2026-13668 Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

MAL-2026-13474 Malicious code in @diezyyasha/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd6b728a9ecc8547f7199d74cfc1070334a586f5fd7fed6e87e332b70945c733 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @jsimplify/errno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb95765882f33f9d81fcfd6fe88ba4c274421923511121b7e9413e77c1dc69d The package declares a scripts.install hook that spawns bun index.js detached and unref'd on npm install, and pulls in bun as a declared dependency t...

Malicious code in @keyv/redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c6bb14bdfcd4aae57a41c9e6e04cd5f612b12e0f45fbcb57510ccb44b095e77 Analysis of @keyv/[email protected] produced no a static rule matches and no traced behavioral findings. The package is a Redis storage adapter for the key...

MAL-2026-11510 Malicious code in beaver-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 465b05640a3068a007c565655d946564a39211eeca92f8637b7c3b4fe9c9dece The package is advertised as a React UI layout library but on require'beaver-ui-layout' loads bridge.js, which reconstructs hostnames from array-join...

MAL-2026-11485 Malicious code in simple-date-formatter-util-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...

Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

Malicious code in test-dev-boot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd45eccde1d78006f2a808730aa4723756d255697ac1479d52aa7e89f792e51 On require/import and when invoked as a bin, the package's main entrypoint detects Windows and installs an...

Malicious code in test-dev-watch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...

Malicious code in @sof-assistant-fe-lib/vertical-faqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d1ba538ee75936802bcb54b49dd258a1941bf7b9f07bc0b05db81fd656c47e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11445 Malicious code in @nordic-dev/linting-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0054a3ea54efe5ff365eb71e92db7d2cb4e92a63854489c148660a82d083c16d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11438 Malicious code in @fuji-web-components/maps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d5e567a52783d2e684e1da23e3d5804652801f44f643834fcb30cea6bbab732 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cr-invested-ui-components/chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c6439b3541927d90da8118ef84eda4e7bedf70c59293c1dc695bb2219135cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11473 Malicious code in metrics-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...

MAL-2026-11477 Malicious code in refbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...

MAL-2026-11497 Malicious code in vite-tsconfig-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...

MAL-2026-11376 Malicious code in scketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eb88342ad8df3fb45f8f72935ab75fc8c7f90f185467a741928f1c27f653cfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fc78fcfb574c958db27a4d94c79bd1ae87c3d5790fdcc044e47f2f97980cfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49d4f90386ec40022f0fad868c745b30d446963edadf0e8fe1a3a4a338ce02d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11236 Malicious code in android-web-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5df19b4396c3027870b8afcfc6ed1d52e466f5f63187716dd1262499e3ab20b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...