MAL-2026-11127 Malicious code in app-sima-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a34ad4e52b9e8255bcfa74cbb6aa18811b0c8d80819a75c6bbfc36d79757b66 The package's postinstall script performs three coordinated attacks against the installer at install time. First, on Linux it fetches an SSH public k...

JLSEC-2026-782

A flaw was found in libssh. A remote attacker, by controlling client configuration files or knownhosts files, could craft specific hostnames that when processed by the matchpattern function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion,...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

Malicious code in habingeer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 716d1a3d9969396f8ca204c03d403552bb4a990c1bfdb4a2ab05dff5afb93748 package.json declares postinstall: node test.js, which auto-runs on npm install and invokes two functions from index.js. The first recursively walks...

Malicious code in app-data-ist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...

MAL-2026-10742 Malicious code in node-as-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 616f74a5722026c25913e644651f1edc57ccb3ca2a6145c1543ff802b3b883b9 On npm install, package.json's postinstall hook runs node test.js, which loads index.js and immediately invokes two harvest routines. The first...

Malicious code in dayjscore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9b2226f2ebbeccf1bcafbec9c51e2b3f13e3a7712dfc22baa79fbb72393b8a The package's package.json declares scripts.postinstall = "node.init.js", causing.init.js to run automatically on npm install. The script harvests a...

MAL-2026-10594 Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

MAL-2026-10592 Malicious code in stripedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b1bd48eb1fe3b563d9950f59df7fcfe699d0f1b51820c47b721f59ee74af34 package.json declares postinstall: node.init.js, which runs automatically on npm install. The script enumerates 60 credential and CI-token environmen...

Malicious code in polymarket-mcp-v2 (npm)

polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on npm install. It steals Solana keypairs, .env secrets and other credential files, and installs an attacker-controlled SSH key into /.ssh/authorizedkeys, then opens port 22 for persistent access. Any...

CVE-2026-49145

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...