Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

MAL-2026-11504 Malicious code in accounts-final-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e67b952090179c0e7ed57045bf117d0cc14ca7d832ddce2963c4f2049b66bb Requiring accounts-final-form auto-runs setup.js via process.nextTickbootstrap in index.js. setup.js selects a platform-specific asset path...

Malicious code in test-dev-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4f4885b543da795140d0ac9c44423c6ecadf74c744c1f322f9d1a5263fe4f2 No static or traced behavioral signals of supply-chain attack were observed in this package. There is no evidence of install-time or import-time code...

MAL-2026-11459 Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

MAL-2026-11464 Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...

MAL-2026-11471 Malicious code in maximumsats-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6163cb4abd0ceee120100e4ce84e0e12bff00348ee3b55ad338d7d1d3adca47d lib/report.js gathers the developer's email queried via gh api user/emails, git config user.email, /.gitconfig, npm config, and environment variables...

Malicious code in easyinstaller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c4ea36235cf092d70fea18574aa582526923d2c869fb9f3846aabb0b180c76a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11304 Malicious code in express-sequelize-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbaa45eca2fa129cc92d16cd7b391a5af5d33fd35dc07a142359357cbf9cb29c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11301 Malicious code in etwl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e526e1b1272a9b3c18948e466b5380d199c4a81ff4ecd198c2ec0dfa2d69bfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11230 Malicious code in @sourav_chanduka/core-no-ngrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cde51a882f2a66e53c2a19231a1963c78555a63a7e2ea9c8e23b378ec072bd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11338 Malicious code in ncc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47e6426d64d44f277630e33c26db683f2d8cc1c043374a88ed3a484c84f7a242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ttest333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b74ff57fa83801c9d727f00ead8619c39184c324bf8c82a1f34c7871154afe76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11206 Malicious code in 1apijs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2700f92a449d39fb0881259de81734a6c2f7933dad7e567fd4284e58b6fe062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11398 Malicious code in testtwix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 156314ac4405e3a399f43088b706e128ab5aad61f32cd5ec0e415af37feda23b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11211 Malicious code in @ethers-sdk/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38a8c103dc06261576987809af8a1deb696dfdabd93bf4116f42ee199ee77cc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11406 Malicious code in unified-help-center-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a76f48c6cd4bfeda98c49e3c091e319501f5566227f6ad6cdb654c193fbe7582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in confetti-rebuilds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f2069e994966cd4c815277183b96ea19c7874fbced968edb527a4ba7a2d0697 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gatorhelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54f5990a3f959ce168ab7ece44797a63a5a61024f2783572d773da2381b47e88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lwp-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f48a24eac1771fb54fd93711a3e41754360ae043cecf84fcff3c3d1bb30d297e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11189 Malicious code in test-skill-zip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90b0b80c790dd0c39844830b06e5388141ddc9a78aa8e79510cb6cd148de1a63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...