MAL-2026-11026 Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11021 Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in encrypt-string-ttak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf72c81030b9346ff3d3dd6f2e5f3395a61d433def25e5e2ea2a7e52a6051999 The package is published as a UniApp 'encryptString' helper but its single shipped module dist/encrypt-string.js is heavily obfuscated obfuscator.io...

Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86481ee3f08109eeaec60a41afb7c2e8d03efd680cc5bf846bdc342ec4205205 The package advertises itself as a high-throughput bulk-mail tool and ships every one of its 50 JS files cli.js, denv.js, helpers.js, all commands/.j...

Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...

MAL-2026-11008 Malicious code in caldryn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c9be7dd8b0d1fe026c48f500d432db06ebfb7bbb0721e3b1426cd29940fd1e No a static rule matches and no traced behavioral findings were produced for this package version. There is no observed evidence of install-time or...

MAL-2026-11016 Malicious code in vantora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b247c0aaff056911572cd72fb377332194aa11aa4ada038039e3c35a6755e2a The package [email protected] 6 files exhibits no observable supply-chain attack behavior. There are no lifecycle scripts fetching or executing remote...

Malicious code in streak-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...

MAL-2026-10981 Malicious code in streak-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...

Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...

MAL-2026-10921 Malicious code in iot-kfh-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...

Malicious code in alb-lambda-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...

MAL-2026-10814 Malicious code in @gocortexio/npmgremlinbox-copyleft-next-0-3-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f08552c1e41d92205380508c0ea3e1b7085f6eba9ed9cadf3ed1610b0957412b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10840 Malicious code in @gocortexio/npmgremlinbox-ms-lpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c00cf6119e52189754e58f2c2460b83968a20c5086aa9424d58123b077c9e7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10841 Malicious code in @gocortexio/npmgremlinbox-ncgl-uk-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00382b16f7bcacbf6333acca5a11b4f1be3a615a64431e0781cf8d9c3877b813 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10848 Malicious code in @gocortexio/npmgremlinbox-simpl-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19cca0040a0e06465540014785a7885bdcb84de6915594fc7b1802db431e67ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10813 Malicious code in @gocortexio/npmgremlinbox-cern-ohl-w-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50f02514f14d3f496876f561a162cf56916c119b18536d6b1c40db9016b70e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10822 Malicious code in @gocortexio/npmgremlinbox-eupl-3-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef5d1488a7448aca043f2c93fd927103279b86134ea8a25e3f86ae29aaa11003 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10829 Malicious code in @gocortexio/npmgremlinbox-lgpl-2-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57c01ac5110fda0b2a3a6bf1ee06fb637561e65d36e549ed3d2bc355183185b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10820 Malicious code in @gocortexio/npmgremlinbox-eupl-1-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97e8d42e9c8b5f383e3cadbce8ef073636d53169b5e36e519cc4611ea1b414b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...