Malicious code in sams-sr-sdk-h5 (npm)

The sams-sr-sdk-h5 package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a 'sams' internal...

Malicious code in enbd-react-error-boundry (npm)

The enbd-react-error-boundry package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization an 'enb...

MAL-2026-10235 Malicious code in tme-error (npm)

The tme-error package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a 'tme' internal...

Malicious code in tme-xca-react (npm)

The tme-xca-react package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a 'tme' internal...

MAL-2026-10227 Malicious code in box-react-uix (npm)

The box-react-uix package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a 'box' internal...

MAL-2026-10230 Malicious code in enbd-react-lib (npm)

The enbd-react-lib package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization an 'enbd' interna...

MAL-2026-10224 Malicious code in @idms-corp/auth-ui (npm)

The @idms-corp/auth-ui package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the @idms-cor...

Malicious code in horde-python-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ae9afcd7af22c82b137c1142ae643502d82f3d1f28712b2e5c7ec412bea85e horde-python-client 99999.0.0 is a dependency-confusion lure. On import hordepythonclient, a daemon thread unconditionally POSTs a JSON payload...

Malicious code in epic-build-scripts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14d466b50466bb93e6e9130d18e67b680c7255beecafe16043dc5ee51bfec886 On import epicbuildscripts, the package's top-level init spawns a background thread that POSTs a JSON payload containing socket.gethostname, the...

Malicious code in ue-python-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66a6d9d874ce102a9ac674f8f713472a473007dc3d51adb869c5198afc708751 On import uepythontools, the package spawns a background thread that issues an HTTP POST to http://109.123.247.172/pypi carrying a JSON payload...

MAL-2026-6735 Malicious code in ue-python-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66a6d9d874ce102a9ac674f8f713472a473007dc3d51adb869c5198afc708751 On import uepythontools, the package spawns a background thread that issues an HTTP POST to http://109.123.247.172/pypi carrying a JSON payload...

Malicious code in unreal-mladapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126bf3493d123333b47fba2ed68e30c085c8266dfb4d16923a81e9ee094f4780 The package name unreal-mladapter mimics Epic Games' internal UnrealMLAdapter plugin and is published at version 99999.0.0 — the canonical high-versi...

MAL-2026-6736 Malicious code in unreal-mladapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126bf3493d123333b47fba2ed68e30c085c8266dfb4d16923a81e9ee094f4780 The package name unreal-mladapter mimics Epic Games' internal UnrealMLAdapter plugin and is published at version 99999.0.0 — the canonical high-versi...

MAL-2026-6697 Malicious code in @sudoughnym/enviro-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02c1c204d0f458d13d7140f4b7a007d551095665a418e9146037be9a5b2b7957 @sudoughnym/[email protected] ships preinstall.js and postinstall.js lifecycle scripts that run automatically on npm install. Both scripts collect...

Malicious code in django-bkvision (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60f6913309b46f7fc428e08267197a375885efc1b3c5660d7707ef70895f558c setup.py executes a top-level function on pip install that collects host metadata hostname, user, cwd, Python version, platform, pid, timestamp and...

MAL-2026-6593 Malicious code in django-bkvision (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60f6913309b46f7fc428e08267197a375885efc1b3c5660d7707ef70895f558c setup.py executes a top-level function on pip install that collects host metadata hostname, user, cwd, Python version, platform, pid, timestamp and...

MAL-2026-6572 Malicious code in rebrandly-domains-digger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1744d2a299b9ef0526f49b4b2297fcd6c72581c51a3359801db56318d8cfda The package declares a preinstall hook that runs node callback.js. On npm install, callback.js collects installer-side identifiers — os.hostname,...

Malicious code in @k18n/creatormarketplace-admin-language (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6213acbcf6c562c8a7690e6018490d502d8df9377a2ed85c5bca9d828ed261c8 Package claims the @k18n npm scope used internally by Kuaishou and publishes at version 99.0.0 — the canonical high-version dependency-confusion shap...

MAL-2026-6481 Malicious code in gx-npm-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04e5ac6b8b24f2c158c37d3d6ac268bbf7f472433660064491538ee468cfcfcb Package published at version 99.99.99 under the gx-npm- namespace, a shape designed to win npm version resolution against private internal packages o...

Malicious code in velocityfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c937a54c3629f80fb7b92fbdafda502706b6028b43bc4675eb30c55d9bc059e9 Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java project from PaperMC and has...