MAL-2026-10712 Malicious code in @hibachi-xyz/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5 On require, index.js enumerates process.env and filters keys matching credential-shaped patterns KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, CIRCLE,...

MAL-2026-10632 Malicious code in cppt-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484688d5963a9246f4fe7a2b5c1c7ebe6bba135a2a5df66b3ab57f44978407b2 [email protected] declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js collects host and user...

MAL-2026-10616 Malicious code in smb-portal-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 395b88ae26544dcfdfca9d46294e1f0558c2e5bade88bac0eb0797d1140debbe Package [email protected] declares a preinstall lifecycle hook that runs node index.js. On npm install, index.js invokes childprocess.exec on...

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

MAL-2026-10456 Malicious code in @spzhongwin/skill-logger-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970980f38a6389d5b622ca41ba3b418f1538b2a38f595536c97acb934012b8b9 The package advertises itself as a skill usage/error logger but, when activated via the openclaw gatewaystart hook, opens a persistent WebSocket to a...

MAL-2026-10152 Malicious code in notifier-funcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da033e00206575ad1328031d625b6c6281332e9ecf5514feae6e99cb285d021 On require, index.js spawns a detached Node child spawn'node', ..., detached:true, stdio:'inherit'; child.unref that runs lib/vcall.js. That script...

MAL-2026-10068 Malicious code in polymarket-kelly-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b668f5fa9e3cce1dd0ddee31443ff3e797c19e9343b750dee86ddef888b02a The package's postinstall script scripts/install-check.cjs fetches a config JSON from a hardcoded anonymous personal endpoint...

Malicious code in chai-defender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f276305fd5e43b60bbfd1048d8792ef7f72734c28cfe533d368c0fc199a0fe On require'chai-defender', index.js invokes launchDeflectBootstrap which spawns a detached background node process running lib/caller.js. That proces...

MAL-2026-10022 Malicious code in @wagni_bot/binance-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecce8bb9640527041b349f2309b950c39c04ed3b3d4de2477c43acc7144eeabc The package advertises itself as a Binance SDK but ships only postinstall.js, which is wired to both preinstall and postinstall lifecycle hooks. On n...

Malicious code in vps-new-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7 The package's main entry dist/index.js re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of...

MAL-2026-7014 Malicious code in vps-new-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7 The package's main entry dist/index.js re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of...

Malicious code in @luminarycloudinternal/lcvis-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8dffb72c9f767cbd071bf482fce9acb1ff2283a4800b7862739348b7a89e24 Package @luminarycloudinternal/[email protected] is published to the public npm registry under an internal-looking scope with an artificially high...

Malicious code in dt-validator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0dd6dc392ad68861c938e7798773adf5359c835743e711a834d84221b481bdf The package's top-level public API dtvalidator.validate — colocated in all with legitimate helpers validateextension, validatesize, and...

MAL-2026-6728 Malicious code in dt-validator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0dd6dc392ad68861c938e7798773adf5359c835743e711a834d84221b481bdf The package's top-level public API dtvalidator.validate — colocated in all with legitimate helpers validateextension, validatesize, and...

MAL-2026-6724 Malicious code in starlette-healthcheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45d8da59826f5074d5b65d3b4733a4da6e7ce20167db9c14f7004e5fb7abe273 The package presents itself as an ASGI healthcheck/request-logging utility, but its advertised configurelogging helper exposed from the top-level...

MAL-2026-6579 Malicious code in lessload (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a5401aaa39f6562549f4fa8298e5bcee579987b837d2440565c37a8f5182dc6 [email protected] impersonates the popular debug package replicating its API surface, contributor list, and description as a 'Lightweight debugging...

MAL-2026-6571 Malicious code in react-wp-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 443f37b7957fe3f1d4dd836b3a0e6eeddb513e334700e0c0a4616570071c13d8 react-wp-viewer 0.2.4 is a dependency-confusion package. Its postinstall hook performs an HTTP GET to a hardcoded bare-IP endpoint at...

Malicious code in velocityfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c937a54c3629f80fb7b92fbdafda502706b6028b43bc4675eb30c55d9bc059e9 Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java project from PaperMC and has...

MAL-2026-6375 Malicious code in gpt-chat-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8890af695b137878736a36dae473487015eb1954c494fec0b5a6041f0817832 collect.js bundles a host-reconnaissance and exfiltration payload. It loads childprocess, fs, os, http, and https, reads os.hostname and os.homedir,...