MAL-2026-17870 Malicious code in @mntv-analysis/ui-components (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 50.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

MAL-2026-17873 Malicious code in @newspage/libx-amount (npm)

npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In versions 99.99.4 and 99.99.41...

Malicious code in @dransay/api (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name...

Malicious code in @dransay/feature-flags (npm)

Source: amazon-inspector cc545bbb96903ee25218d8cab1a7d116d2ceb1ba64a3c929c79e56a6fc8e0585 @dransay/[email protected] publishes a scoped name on the public npm registry at an inflated version 99.0.0 designed to win semver resolution against any private internal @dransay/ copy. package.json...

Malicious code in @dransay/secrets (npm)

Source: amazon-inspector aef0f6b36413e45664391c5341f7c30a4501c2cc916add9ba6525bf57e559d51 The package declares a preinstall script that runs beacon.js, which performs a DNS lookup and HTTPS GET to a hardcoded Interactsh collector host db3klhbi6i9hark1kegg174t38h33b6wt.oast.site at npm install tim...

Malicious code in dransay (npm)

[email protected] is a dependency-confusion probe for an internal unscoped dransay package name, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using dransay-unscoped ...

Malicious code in @dransay/logger (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package...

Malicious code in @dransay/feature-flags (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the...

MAL-2026-17697 Malicious code in @dransay/logger (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package...

Malicious code in @dransay/phone-fix-test (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the...

MAL-2026-17698 Malicious code in @dransay/phone-fix-test (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the...

Malicious code in @dransay/api (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name...

MAL-2026-17699 Malicious code in @dransay/secrets (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package...

Malicious code in @dransay/secrets (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package...

MAL-2026-17695 Malicious code in @dransay/db (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name ...

Malicious code in personio-pipeline-projen (npm)

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username,...

MAL-2026-17642 Malicious code in personio-pipeline-projen (npm)

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username,...

MAL-2026-16477 Malicious code in com.apple.unityplugin.storekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca The package impersonates an Apple/Unity StoreKit internal namespace com.apple.unityplugin.storekit and, on require, index.js performs an HTTPS GET to...

MAL-2026-12432 Malicious code in runtime-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f44234b49595ac2b15e3b5249920f7ff64cf897b7543da959e95621814948da1 The package's postinstall script src/test.js issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled...

Malicious code in mw-server-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1401412848e55e1515db44b1f513ad6e39628f06c24c3b057a08448c9e8ee44c mw-server-util 2.0.1 ships a postinstall hook that runs mw.js, which reads os.hostname and os.userInfo and issues an HTTPS GET to a hardcoded Burp...