MAL-2026-2653 Malicious code in pinlogger (npm)

The package is a malware due to system info exfiltration via DNS/HTTPS to OAST domains and arbitrary code execution during preinstall. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e78bb72f47ecca78511d87a17bea5f38fb4897dbc117433dfd7667cd97a51d0 The package...

Malicious code in base-or-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2deff4ab9db147fda78b79b3687e76c9d46381670c58924f03f852518002a649 The package base-or-engine was found to contain malicious code. Source: ghsa-malware d6d4b7d60db50af8f8a9614f9ac0a742cf6472998e11e6233c6190b518332958...

Malicious code in @logcore/pino-pretty-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a729cc1811bd1bc1fa94404ad4bcd8376c1a29b90311fd2a89efecff51fe592 The package @logcore/pino-pretty-logger was found to contain malicious code. Source: ghsa-malware...

Malicious code in jellyfi-pino-pretty-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d1230eb2336763c228ba6ac98d349f8cc64a1ae28755d8da374f336e77aa928 The package jellyfi-pino-pretty-logger was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2200 Malicious code in json-lucide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12d05056fbe7eca08a66d7297aac2b03763073361f0cb33c238a4463f64a0867 The package json-lucide was found to contain malicious code. Source: ghsa-malware 30298bc83e4bdadd246cfdec7006f865348448a5147e0a8258cd4d4feaf7b27f An...

MAL-2026-2199 Malicious code in omicnavigatorwebapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 327bf8baa88f730faf7a3b96a6acc527533ef6b39c5274246cfc00c72d6c30d2 The package omicnavigatorwebapp was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-as-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bcf6b93b6186112457361f81d21c00830bf0c48c75763de88d97f1b075944cf The package chai-as-chain was found to contain malicious code. Source: ghsa-malware 1d06397b7e66c2a8ecf1542a1f7d18b0f5a87d08a276dc88f77b1f8b2d818d47...

MAL-2026-2130 Malicious code in fancode-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56c163153700b6fef7090e078a98b7c2403088e5c5f487344dc419af8adaa7 The package fancode-web-app was found to contain malicious code. Source: ghsa-malware a933e6c673f3cf2c4cb0e768570b64dcf627ac59e6b29c2e9afd5a5fb3d4396...

Malicious code in cr-static-shared-components (npm)

Malicious package due to code obfuscation, dynamic module loading, suspicious email, and arbitrary code execution during installation. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcc8531926534d3d87af7c173bfaba5f563bdbbc6ae8293de0150a0f00ba205 The package...

Malicious code in pulse-rsvp-card-entity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d02d6daeedd5d906c300edc9ce1c430366876726cb5f6c69156b785a38713ad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pulse-shop-section (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9973ec50205f8457c7d27feb3e60011e3fe79d4e0d1b7cbeaa30bc38e98e9d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ty-fragment-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88bca7665eab3ba9300549f837880aea1567494c90187abacee03c85eaeb99e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @emilgroup/claim-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e875cfffc40fe2f586c2016b175709687e5644132193d058580c55b789f64482 The package @emilgroup/claim-sdk-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in @emilgroup/insurance-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204ac599e2496ac1b276283252ae142c05b28ebf89e2f63d3a0c664f2ccac7af The package @emilgroup/insurance-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2050 Malicious code in @emilgroup/insurance-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204ac599e2496ac1b276283252ae142c05b28ebf89e2f63d3a0c664f2ccac7af The package @emilgroup/insurance-sdk was found to contain malicious code. Source: ghsa-malware...

Malicious code in @emilgroup/gdv-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c4f423945b0d9a114bae821ae46ab06d9850ba5611917eb80d940c47771e3ed The package @emilgroup/gdv-sdk-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-leaflet-cluster-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0518fae392cbcd2e3f43b08af24b6736a313bcc053d67bfece2c36c7e609373 The package react-leaflet-cluster-layer was found to contain malicious code. Source: ghsa-malware...

Malicious code in @fr3newera/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fba6d334ab723d77261982b048c8728dfdd60454bac47a0c23322ac7251e4c8 The package @fr3newera/baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1979 Malicious code in rollup-plugin-polyfill-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985c6e7bc0975c513137b35a6dca07cf02aa2b87444716244933ca17d56c6bd2 The package rollup-plugin-polyfill-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in woltpickerapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a6352ffe541b2fd35eb37ebb5dbdc78f1f57a51d31b36c6fcae39d21f97c594 The package woltpickerapp was found to contain malicious code. Source: ghsa-malware b0c8234f6a72b4da77be49eb19f15dc41dd1d94b6b8b9bc4bffd3ef9ddb4316b...