MAL-2026-10137 Malicious code in type-elint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f29d6bfc122cb5792d95cfade56e62789f83366b30fc0d58a88a84113d89962c Package impersonates the pino logger README is pino documentation, package name is a lookalike. The main export is a middleware factory that spawns...

MAL-2026-10130 Malicious code in type-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37979cc60cff25e26406f3426f0dd7aeac12c13e55402c89f78228080cac0ad9 The package advertises itself as a pino-style logger but its exported middleware spawns lib/caller.js as a detached Node child process. lib/caller.js...

MAL-2026-10092 Malicious code in vite-pwa-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab1e251883a8eceecc27c935ed05352375d438c1efbbd8727f2b13a766409d0 Package vite-pwa-config impersonates the popular vite-plugin-pwa antfu — the README instructs users to import configJson from vite-plugin-pwa, and...

MAL-2026-10087 Malicious code in eslint-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbc3baf80e31e8027d7bb5b3fe5a873c5ff72d8344d39f8f01e191699a2310d7 Package declares postinstall: node lib/utils/index.js, which spawns a detached, stdio-suppressed Node child spawn with detached:true, stdio:'ignore',...

Malicious code in eslint-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbc3baf80e31e8027d7bb5b3fe5a873c5ff72d8344d39f8f01e191699a2310d7 Package declares postinstall: node lib/utils/index.js, which spawns a detached, stdio-suppressed Node child spawn with detached:true, stdio:'ignore',...

MAL-2026-10047 Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

Malicious code in chain-chai-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 655c64cb99f74a3b96f1b5e1d0102ce0c756e63368a5ca252e70e49e98f346b3 [email protected] impersonates the pino logging library README badge links to npm/pino, exports module.exports.pino = middleware, and ships file...

Malicious code in chai-promised-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ddaac3e93ed2e5d968816cf3153b2ab1878580bb9ee65ec3ec1acdca41dc018 Package masquerades as a chai-as-promised plugin / pino logger README and exports copied from pino, including module.exports.pino = middleware but on...

Malicious code in chai-as-serialized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e48e8980927471640c6573406d988d1a4361759f14a952da36c5daa1c9fd3c The package's main entry index.js spawns a detached node child process running lib/initializeCaller.js as a side effect of invoking the exported...

MAL-2026-10046 Malicious code in chai-as-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbeb8dc929ba80789f3386d489e22fc4efa5fa43b2901a4d6aa8524c03168a58 On require, index.js spawns lib/initializeCaller.js as a detached background process. That script decodes a base64-hidden URL...

Malicious code in chai-redirection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38236fbbdbbaa8f8ed9315c3a4ff01fbf049215896036b1cb68611681fe0eb00 chai-redirection presents itself as a chai assertion plugin but its main entry index.js unconditionally spawns a detached Node child process running...

Malicious code in tailwindcss-effector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4780f88b1924c1d5104a4ea18803a0180e9339e5c9a9bf787f9ed4901e1729e3 src/index.js appends a heavily obfuscated async IIFE after a legitimate-looking TailwindCSS plugin. On import, the IIFE issues HTTPS requests to remo...

MAL-2026-6350 Malicious code in chai-as-operated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927e5f9d908ce243e10ddf51e2463ac96c6f685790ec9f35dcc7309c90ad8407 Package name impersonates the widely-used chai-as-promised README instructs chai.usechaiAsOperated and the README badges further impersonate pino...

Malicious code in @glitchpad/throttler (npm)

@glitchpad/throttler malicious version 2.2.3, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern...

MAL-2026-11203 Malicious code in @dexwilt/node-fetch (npm)

The @dexwilt/node-fetch package impersonates the legitimate node-fetch project: its package metadata copies the upstream repository, author, and homepage while publishing under an unrelated scope. Its CommonJS entry point lib/index.js contains the expected node-fetch implementation followed by...

Malicious code in yianzzkf6687 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a59a0aee58573b3030b9d541980fa9d7df8ea55d4e6cc5b3bb349452b908d0e9 On npm install, the postinstall hook scripts/postinstall.js detach-spawns scripts/shell.js with detached: true, stdio: 'ignore', windowsHide: true an...

MAL-2026-6216 Malicious code in aikaf668897 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 450730a92143c06530923dacda588a17252ebc7edc9ddf71ff520446de5a3293 On npm install, the package's postinstall hook node scripts/postinstall.js spawns a detached background Node process running scripts/shell.js with...

Malicious code in chai-assert-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb347379535c0ea9895e1dc8dd2f20b1fd092b8e62b433bfbd49b2ac1bff2f72 Package name and metadata impersonate the 'chai' assertion library reuses chai's contributors, description, and a 'chaiassert.com' homepage, but the...

MAL-2026-6221 Malicious code in chai-assert-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb347379535c0ea9895e1dc8dd2f20b1fd092b8e62b433bfbd49b2ac1bff2f72 Package name and metadata impersonate the 'chai' assertion library reuses chai's contributors, description, and a 'chaiassert.com' homepage, but the...

Malicious code in requests-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfd9564690d64c44a730b088f4295c75b36e9d2fb164e2c7aa9ec2367153ada6 The package masquerades as a typosquat of the legacy request/requests HTTP library, copying that project's README, dependencies, and source files...