Malicious code in beaver-ui-items-with-more (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c1daccfac428195187be33025eb0f9094d2196ca643e3eb339e74a24c215ba1 The package's declared postinstall node setup.js and its main entry index.js which unconditionally calls require'./setup' fetch a platform-specific...

Malicious code in @web3utils/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba3a3a1b390694579fc5d75ee83e18f9b378d1206ae499c43c744c889d3fa862 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11256 Malicious code in chalk-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 481067cbb929fab749f6e643d96126d0c74251e48609cce55eebf477cfd9ad99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in open-worker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f401caae6648708b54670a92075c2ff4fa6fb10f86a7ad73be5fa19eacae2fed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-motionkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84dfdf101e36c7ca60ca1a1e72d59a7893a5abee9bf359852cdeabdb0af2cd2 Review of [email protected] surfaced no evidence of exfiltration, install-time remote code execution, silent relay, credential distribution,...

Malicious code in ishowfeet13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20bca534c9132e075eb12129f9986f32127805ef4e81a801de877aaf3a9bda6e The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10017 Malicious code in rabi-snooze-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 817c839ae17d82809b3dc9cb252237dc512d80339b11fc28c544a002e53128e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nonexistent-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9393b3fc67ac5c169de7089d2f5100b5cb49af4e2b747b46726660bebc2bf66a No a static rule matches and no traced behavioral findings were produced for this package version. Nothing in the analyzed artifacts indicates...

MAL-2026-6872 Malicious code in rma-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fcbaad039ecd69789daa0857a674926917f7a439656144587a9fc441968e97c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-scroller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57d21e3f2b10a543d5deb6a3999b78e5414b55ad958ff7811d802cb42386fc8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6813 Malicious code in custom-log-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c9faa938597e0a32ee3af2079e27bf57cb7cbe8953841b03fe33d51a154899d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6801 Malicious code in big-numerate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce8db0e9acf515c5cbd257b94ec544bc6b268e27ca8147bfe1b9ec4316e8d4ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @report-portal/service-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7cda87aca7d018bc03c6897a4b7a1a849ffc93490d449277055972f54577444 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6358 Malicious code in fetch-page-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20a04be5fca12f18a1dc5791b41fb0e1b9feac721b8d12747f32b00a18cb67c babel.config.cjs contains a heavily obfuscated obfuscator.io-style IIFE appended after a legitimate @babel/preset-env block. It queries multiple...

MAL-2026-5844 Malicious code in numdifftools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6d98d619244a4f34ba9c2ed85023e35f4064b0a45871edac806d1e8cdeff11 The npm package numdifftools is an empty shell zero-byte index.js that exists solely to fire a preinstall lifecycle hook. The hook runs node -e to...

Malicious code in coinbase-wallet-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ab9b05ffef17005997a718b420c7842eaa66c9e8b6586f8f62ccaeeb3d35a4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in foundy-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d117fe522ec0aee9271963b02fb9a61b7e5005b5494331368b58f46c05c944cd On npm install, the package's postinstall script runs an inline node -e that shells out to curl -fsSL against an ephemeral Pinggy free-tier tunnel ho...

MAL-2026-3276 Malicious code in accesso-angular-cache-buster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efe1cff5329801850c1249ccfee1e905acc9e221c3bd424534068908f73b5a07 The package accesso-angular-cache-buster was found to contain malicious code. Source: ghsa-malware...

Malicious code in vime-azl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a86b8ee643a9ac9cb7529c19293e56a1ccefe33d616c0459e90c364f529a55d2 The package vime-azl was found to contain malicious code. Source: ghsa-malware d7731c972c51221a2f0a582c0f7d25c9054e45942accb77b36d8a170074c8ade Any...

MAL-2026-2853 Malicious code in react-hook-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ae372e5061ef357237d48a7812ca65bbc3a49b8a57153df5812d17e9d8eeaa The package react-hook-form was found to contain malicious code. Source: ghsa-malware 5aa9ba7a4ea0b89453bdd073b8ffb80b6e3baab6684d5652a1e898c2bacb5a6...