MAL-2026-17226 Malicious code in figlet-chalk-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5ccd0a988525d8128b520a46c4271e26ae5fe2f99accf28f37d4c7370b66de4 On every require'figlet-chalk-render', a top-level IIFE queries https://registry.npmjs.org/figlet-chalk-render/latest and, if a newer version exists,...

Malicious code in figlet-chalk-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5ccd0a988525d8128b520a46c4271e26ae5fe2f99accf28f37d4c7370b66de4 On every require'figlet-chalk-render', a top-level IIFE queries https://registry.npmjs.org/figlet-chalk-render/latest and, if a newer version exists,...

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation JXA dropper mechanism, but modify th...

MAL-2026-17176 Malicious code in n8n-nodes-moonlet-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec Package presents itself as n8n helper nodes but ships an empty stub index.js module.exports = and no functional node modules. On npm install,...

Malicious code in n8n-nodes-moonlet-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec Package presents itself as n8n helper nodes but ships an empty stub index.js module.exports = and no functional node modules. On npm install,...

MAL-2026-17179 Malicious code in wallet-connect-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d The package's postinstall hook runs node./loader.js, which base64-decodes an 8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and...

MAL-2026-17178 Malicious code in secure-env3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb86188f9853b34c6dc3cf9c8259a789920326e8ddf4ae4cd3566385bba3ea1 The package presents itself as a dotenv-style environment loader but ships a Windows dropper that fires automatically on module load and on CLI...

Malicious code in secure-env3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb86188f9853b34c6dc3cf9c8259a789920326e8ddf4ae4cd3566385bba3ea1 The package presents itself as a dotenv-style environment loader but ships a Windows dropper that fires automatically on module load and on CLI...

Malicious code in chromatitle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793cf7eb2b4de9c41e229fc89c393e38f05141991762f69f310e1397fa464f9c chromatitle advertises itself as an ANSI color/title formatting library but its main entry src/index.js unconditionally calls bootstrap at top level,...

MAL-2026-17173 Malicious code in chromatitle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793cf7eb2b4de9c41e229fc89c393e38f05141991762f69f310e1397fa464f9c chromatitle advertises itself as an ANSI color/title formatting library but its main entry src/index.js unconditionally calls bootstrap at top level,...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The payload does not run at install time, but upon invocation of the package. A language-specific loader then...

Malicious code in tlxbnhd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e415dbf226269704c2cd28b1783cf594f96880dd4688b26caf7f25a19e268237 The tlxbnhd package ships obfuscated preinstall.js and postinstall.js lifecycle scripts that, on npm install, download two files from...

MAL-2026-16385 Malicious code in tlxbnhd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e415dbf226269704c2cd28b1783cf594f96880dd4688b26caf7f25a19e268237 The tlxbnhd package ships obfuscated preinstall.js and postinstall.js lifecycle scripts that, on npm install, download two files from...

Malicious code in mxdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...

MAL-2026-16349 Malicious code in hardhat-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95 Package published as hardhat-devkit presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README,...

MAL-2026-15969 Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

Malicious code in jwt-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b56e3f2d5fab071637ba7688de6c2a9c3d1c1846b6ec939b82eb2c8e9ff03956 The package is published as a trivial JWT logging helper but its main module jwt-logger.js is a heavily obfuscated string-array dropper. On require, ...

MAL-2026-15991 Malicious code in jwt-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b56e3f2d5fab071637ba7688de6c2a9c3d1c1846b6ec939b82eb2c8e9ff03956 The package is published as a trivial JWT logging helper but its main module jwt-logger.js is a heavily obfuscated string-array dropper. On require, ...

Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...