Malicious code in microsoft-employee-experience (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c34bc4b2b8497b2f155f93295b0fe4b78eb94e7830684929547465d0b66b7a7 The package microsoft-employee-experience was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3017 Malicious code in react-spa-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43b35510ff33bc6f887152176f91fb63f2a336c8822c151ac6039ccced83c96b The package react-spa-npm was found to contain malicious code. Source: ghsa-malware c9044f471d6c131db0da2c97994b81cd8d2680486695f42dec152b2b23f5e0be...

MAL-2026-3016 Malicious code in amazon-q-developer-streaming-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2612d348229614bb857a8f2c30c1ad2d66954d7a05073f15319f8aca2fb1a86d The package amazon-q-developer-streaming-client was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @bmg-web/bmg-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d560386e011639d154483a6156d3ffca4b0f0c58b20063d6e8ea51d5a295d2a The package @bmg-web/bmg-dialog was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2985 Malicious code in @bmg-web/bmg-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d560386e011639d154483a6156d3ffca4b0f0c58b20063d6e8ea51d5a295d2a The package @bmg-web/bmg-dialog was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2983 Malicious code in @bmg-web/bmg-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1670cde81640c3ef6602cd58c332cc7af5d682ac200e16addc67e3afcc2ff67f The package @bmg-web/bmg-checkbox was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @bmg-web/bmg-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3145866a6b18a164c2246b0a000b18412f9f8cc10f5c4192a2a8925d213bedb1 The package @bmg-web/bmg-grid was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2988 Malicious code in @bmg-web/bmg-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3145866a6b18a164c2246b0a000b18412f9f8cc10f5c4192a2a8925d213bedb1 The package @bmg-web/bmg-grid was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2986 Malicious code in @bmg-web/bmg-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba8b2c9cb8ff59d283200d129e3ad62a7f469072326443114ebadcda2da4f894 The package @bmg-web/bmg-dropdown was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2967 Malicious code in 6161test1234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074806dcf23de8a6066ce2cbbcc5f711ca552db945714be52cd8d3a7e1415af4 The package 6161test1234 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in megabank-worklist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f0a379223d486978f097d6f97b1d3a1fd307bb725be56c7baa2bc8ff72d297 The package megabank-worklist was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2921 Malicious code in chandan-module-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9b92ee71a8547073a6d21685e6190b1769e93db8cbf2be1a57e7e14e8d0d075 The package chandan-module-test was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in rtms-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18da37bf0615d0c7dceb6be7eb89956f39de56bbc90f65d9398fbfb3f9455dc The package rtms-manager was found to contain malicious code. Source: ghsa-malware e276637a6f1590e66766c1b420f9a89805451c2c71a8d199165f127d3e413a31 A...

MAL-2026-2862 Malicious code in rtms-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18da37bf0615d0c7dceb6be7eb89956f39de56bbc90f65d9398fbfb3f9455dc The package rtms-manager was found to contain malicious code. Source: ghsa-malware e276637a6f1590e66766c1b420f9a89805451c2c71a8d199165f127d3e413a31 A...

Malicious code in react-resource-router-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74666c1336dafeaefaa96b6bf71ae8a216aa4eaded1151bbd390c0cb913d1697 The package react-resource-router-next was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2851 Malicious code in @indriver-poc/whisperwind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7543a4315d192afe241577899d5777567678b591c400103ba3da0dc46f1b1d55 The package @indriver-poc/whisperwind was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2822 Malicious code in ing-web-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f32dd0f0eff32e970526305378a6623e9af62ab133ddcf04a21aa92f1eb95f26 The package ing-web-v5 was found to contain malicious code. Source: ghsa-malware 9e7004b49a2628c8e4ae0eb894bf23d52b8c6bef3911ea2ce955dda180f237d8 Any...

Malicious code in emergentintegrations (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fce023cdc4fa1509dbc8512d9b3728d4f5944941a522f63b94ef27b764ee4fbd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2668 Malicious code in pnpm-workspaces (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19d252b93a40f90995892530ecd34dc35e9ec7e5b741cb02416fd3dde3e082d8 The package pnpm-workspaces was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2920 Malicious code in buffer-util-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374d8c5c4c32544741d1ea3788cfbccc3ee175f7181f8bdfa71cf4fde44121eb On require/import, index.js decodes a base64 string literal to https://www.jsonkeeper.com/b/CWOV9, fetches that anonymous JSON paste, and passes the...