Malicious code in ngsw-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b427c73f093ad680033b2779c43c1c96186a71055aaff3cf44befd18c2cecbd The package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node version, package/lifecycle name...

Malicious code in gemini-cli-a2a-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, Node version, and package/lifecycle metadata...

Malicious code in gaarf-node-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an...

Malicious code in gaarf-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0 On npm install, the package's postinstall lifecycle script collects installer host identifiers os.hostname, process.platform, process.arch, Node...

Malicious code in chromeos-webdriver-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bbf3413f6465a1f8bb628dcdb79f59ac7c197bbfba2024202c9915f95ad8161 The package's postinstall script runs on npm install and issues an HTTPS POST to https://kvpq6u62.instances.poc.jchunt.top/chromeos-webdriver-cli...

Malicious code in chrome-enterprise-premium-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850bd071a15b1c20097032c5861cdfdeb970d05b4e28f65d5bcdb411fba5d10d chrome-enterprise-premium-mcp ships a postinstall lifecycle script that fires automatically on npm install and POSTs installer host metadata...

Malicious code in bazelisk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bcbd35130e716d1a2940c91b6691d41b9655fdc8587404af37bc6e5a7f1370 This npm package uses the name bazelisk, colliding with Google's bazelbuild/bazelisk project referenced in the tarball's source.txt, and self-labels ...

Malicious code in @mohamed_nowisar/token3-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457 The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the...

Malicious code in mtslink-depconf-probe-profileusername (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f679922753b7a59c59af851ae74275b5d4760b13fc516bc8c68e8e9568393dc6 Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.c...

Malicious code in optimizely-starter-kit-for-fastly-compute (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...

Malicious code in bcc-design-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f25ef58a44d6da495f8f9cd06686303901d391069000f5a10d09694b68241e2 [email protected] declares a postinstall script node./notify.js that runs automatically on npm install. The script performs an HTTP GET to th...

Malicious code in bcc-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80 [email protected] is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webflux - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...

MAL-2026-14069 Malicious code in kb-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d69143a6cdc0a652f91210034751420f7ada3db2a13d81d9e635e3a63333dc5 On import kbai, the package's init.py triggers kbai.utils.callback, which starts a background thread that collects installer host identifiers hostnam...

Malicious code in kb-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d69143a6cdc0a652f91210034751420f7ada3db2a13d81d9e635e3a63333dc5 On import kbai, the package's init.py triggers kbai.utils.callback, which starts a background thread that collects installer host identifiers hostnam...

Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

MAL-2026-14068 Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: falco-exporter-fips, kube-state-metrics-fips, grafana-agent-operator, crossplane-provider-aws-appstream-fips, crossplane-provider-azure-storagesync, pushprox, cloud-sql-proxy, headlamp-fips, kubevela-fips, crossplane-provider-aws-glacier-fips,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: falco-exporter-fips, nova-fips, cloud-sql-proxy, headlamp-fips, timestamp-authority-fips, grafana-rollout-operator, frankenphp-8.2, crossplane-provider-aws-rum, crossplane-provider-gcp-beta-container-fips, whereabouts-fips, cilium-envoy-fips, perses-fips,...