Malicious code in exnesss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184796b4aafee8400786643e9f43338886de2166171c62879cfd4c023655b487 Package name 'exnesss' typosquats 'exness'. The package.json declares scripts.postinstall: 'node./postinstall.js', and postinstall.js issues an HTTPS...

Malicious code in @ks-radar/radar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe5f14a06be3c24f9b771e8bbe33139614129069d276962f0c7e019fd89cbce On npm install, the package's preinstall lifecycle script preinstall.js reads a hex-encoded command string from preinstall.json, decodes it via...

Malicious code in whs4_deu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb5c50b57f755039aeebab19cba308fd86dad10eddad29a94ab09396fdfe6f5 package.json declares a postinstall script node index.js that runs automatically on npm install. The script resolves an absolute filesystem path via...

Malicious code in identityscimapiserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e866098aa6115f837577cc3b24eae409fb1fb67167757f2f0c5517dfa9d8d209 The package's preinstall hook runs index.js, which collects hostname, platform, architecture, home directory, and DNS server list via the Node os...

MAL-2026-11061 Malicious code in identityscimapiserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e866098aa6115f837577cc3b24eae409fb1fb67167757f2f0c5517dfa9d8d209 The package's preinstall hook runs index.js, which collects hostname, platform, architecture, home directory, and DNS server list via the Node os...

MAL-2026-11055 Malicious code in fundraiserservicepp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6356b654b692d4c1222f3dc31dcfad683a6e193a41484d3c617c7c8d52db2313 On npm install, the package's preinstall lifecycle executes index.js which collects os.hostname, os.platform, and os.arch and POSTs them as JSON over...

MAL-2026-10965 Malicious code in requestor-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8a60f357ab63e9818e450e4e4aec3dcf1b08d1242931ad5ad8468a460ee82ba [email protected] is a hollow wrapper empty index.js, placeholder 99.9.1 version whose only effect on install is to resolve a dependency declared...

Malicious code in ue-jenkins-buildkite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3f4ff9ea00766589ae9dece7648aa4ce29ac9bc82173fce0a1adefaeb6c8f5a [email protected] is a dependency-confusion package targeting an internal Epic Games / Unreal Engine CI namespace name evokes...

Malicious code in dttfdsdee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae565bed85ec0db27f1ff658c7e9491591ce40edc56f423cd8b1122bc209c69c package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem with find to locate databas...

Malicious code in @zimmo/last_search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbddb0ebcd12d13ef5eb1f2cb4e0e41f49b00808e4d23a15b5c22b7ecb23da4d The package's preinstall hook runs index.js on every npm install. The script collects host identity data — os.hostname, os.userInfo.username, dirname...

MAL-2026-5286 Malicious code in encrypted-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c60d89261c09dc6eaea0a3af26af55519421cb927a1b8183009d09b2d4e99b94 On npm install, the package executes a preinstall hook package.json "preinstall": "node index.js || true" that runs index.js, which performs a DNS...

Malicious code in cms-store-ren (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3593e36ce898d648883ea6f911a5cec1f75f9e8bda5585f7ff5f8754c821de The package's scripts.install runs install.js on every npm install. The script unconditionally POSTs the installer's hostname, OS, and architecture t...

Malicious code in unleash-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3315b3ff9fe481a7a008cff1227c2449dd8762bdf0abbe1a6194954306c745d [email protected] is an empty stub package index.js exports , 35 bytes; no author, no description whose sole effect is to pull a chained dependency...

MAL-2026-4169 Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 940faf3ecfa6ee3c09c995a5f124d4a3b53bf2e2e5eaccea8156ce7bd25494eb The package paysafe-gbp-virtual-assistant-lib-fe was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in citrea-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd20c7509b081678aafda4ba6ba713f0604260082e2a52d79f0fb94a49a2ba52 The package citrea-sdk was found to contain malicious code. Source: ghsa-malware da76b8e09db42c5bea1b9b971c8ea392e906f297b2931f289c3960ffc04a6e3f Any...

Malicious code in deepl-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f09b2cb596d2186d9533b703e85192087a2722c8307c51428330658f1972c3a The package deepl-sync was found to contain malicious code. Source: ghsa-malware 901de6816216276cc07830e358c2cae608d89087dba87b4acf0562604011e504 Any...

Malicious code in cplace-bmw-emt-mvp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b6d2d57176a41f11e925988396ad8549efc86508c1cc13a7130871f48c15b33 The package cplace-bmw-emt-mvp was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @matjp/dvi-decode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 285904d13f5d698c3c33461fe969265ca73c3041db80eabe5637c1ebd3f3ca9b The package @matjp/dvi-decode was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3373 Malicious code in owa-analytics-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 644a42250298e29b58f2cfe75c1d362637e2c31f1a1ef9b9cfbe5d9ff0475fb8 The package owa-analytics-utils was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in mrdaa-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757aca74d8d75ecde7421f2c632969a5b34c11a279d9d28b75755c2ca0825ceb The package mrdaa-frontend was found to contain malicious code. Source: ghsa-malware 0b6c586cd7adad52516658de8bbb3eb18f166350414f223fd73fe34a240d6948...