MAL-2026-12127 Malicious code in a.poltoradnev-package-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a193f48dce179cc9b43bc16917f5a04d89975c3451ebd33f766545c1c168664 index.js the package main requires setup.js, which schedules bootstrap on process.nextTick, so the dropper fires on any require of the package...

Malicious code in aasp-tent-aasp-tent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f40a1f6a1ee90eed076db7cd24155d8dd0ceb6f3bd3b0698eb9ff0b0543efee On require of the package, index.js loads compat.js, which detects the host OS/arch and fetches a per-platform native binary from author-controlled...

MAL-2026-12308 Malicious code in vvvedernikov-test-another-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69575654ed937cf00fb8e19691a12f08f966639ceec4ddc306d65a5af0ab8f83 On require of the package, index.js loads bootstrap.js which selects a platform/arch-specific asset path, fetches opaque bytes over HTTPS from one of...

MAL-2026-12129 Malicious code in accounts-appointment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85924ae1e24ede2acf333de8af5ca1d8ae2854652be2b3b82a01df710adc27a index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.de...

MAL-2026-12221 Malicious code in tailwind-custom-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2 The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at...

MAL-2026-12263 Malicious code in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc7dae6b0c575dcb758eec30a647592471c39ded904ff4ed379cadd93b4f6cf4 index.js requires./polyfill on load, which selects a platform-specific endpoint, fetches an opaque binary from runtime-assembled Cloudflare Workers...

Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-statist-browser-typed-client-dwh.chimera.base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e85e012cccc354c615a7d3fc6f753b676fa6f56e1053170a6e24f173ad930008 Requiring this package triggers support.js to select a platform-specific asset, fetch an opaque binary from string-split-obfuscated Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd094a1c3c67af1fc7372e62ed565847fcf26962f3b90e53a5df200390c07a99 On require/import, index.js loads bridge.js which selects a platform-specific endpoint and downloads an opaque executable over HTTPS from hardcoded...

MAL-2026-12245 Malicious code in tinkoff-pfp-atom-desktop-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd On require of this package, index.js loads loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomiz...

MAL-2026-12271 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

MAL-2026-12216 Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

MAL-2026-12141 Malicious code in beaver-ui-actions-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1daeb30fbebca53883598794ed1662b3d15aca34b78d29257a477431a47201fd The package is published as a React components library but ships no React code. On library load, index.js auto-requires setup.js, which constructs...

MAL-2026-12187 Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

Malicious code in accounts-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on...

Malicious code in simple-date-formatter-util-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdd747d615be16a4af8508b6151d829c49f8ba2e1d045b8c1cbc9d8f2f219de9 package.json declares a postinstall script that, on npm install, collects installer reconnaissance id, hostname, uname, cgroups, docker.sock, Linux...

MAL-2026-12202 Malicious code in simple-date-formatter-util-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe9863d2e47d22ca16f42efd68d0c79e0b2730b48984bf68b040f6f920fb70ec Package presents itself as a date-formatting utility index.js is a four-line toLocaleDateString wrapper but its package.json postinstall hook runs an...

Malicious code in simple-date-formatter-new-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6 package.json declares a postinstall script that runs a shell pipeline collecting host identifiers uname, id, routing and ARP tables, TCP-probe result...

MAL-2026-12197 Malicious code in simple-date-formatter-new-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6 package.json declares a postinstall script that runs a shell pipeline collecting host identifiers uname, id, routing and ARP tables, TCP-probe result...