Malicious code in sm-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2741ebbd0df8c6f349a4d34361cc3d814fe878f3f4521fd771a855cfdc152b Package [email protected] defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardcoded bare-IP endpoint at...

MAL-2026-13986 Malicious code in notafollower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768 [email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. T...

MAL-2026-13976 Malicious code in check-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723c3dbef875102d9d461c655737b930ea9f58f2a5555bd254d954d7003eacf5 [email protected] is an otherwise empty package no author, no description, no meaningful code whose only effect on install is to pull a dependency...

MAL-2026-13987 Malicious code in resolve-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c [email protected] is a stub package index exports an empty object whose package.json declares its only dependency ltidisafe as a direct HTTPS...

MAL-2026-13968 Malicious code in @hzero-front-ui/cfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d280060b3d704c67c4a2cc853fde425220e6a3606f71269daa8a9b3e74052f6d package.json declares preinstall and install lifecycle scripts that, on npm install, collect whoami, hostname, current working directory, and...

MAL-2026-13752 Malicious code in chapters-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992 The package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.hostname, os.userInfo.username,...

MAL-2026-13440 Malicious code in connect-contingency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a03c555705f2bfa2e63b96e9ea5740196d1ea5ca8be0f1acce290c771f01ea [email protected] is a hollow package whose index.js is an empty stub. Its package.json declares its sole dependency ltidisafe as a direct...

MAL-2026-12383 Malicious code in foodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299310eb47eac6e7f39ee1a7346de8e524d9a91cc6a07d2e8879338fa86ff5af package.json declares preinstall and postinstall lifecycle scripts that both execute curl -X POST -k -s...

Malicious code in frontend-regulations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d88817d57907505adf7d303019c78adceb6da7bedf1e3416f2b9a1e80605ca1 [email protected] is a near-empty wrapper index.js exports an empty object whose package.json declares the dependency 'ltidisafe' with the...

MAL-2026-10415 Malicious code in frontend-regulations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d88817d57907505adf7d303019c78adceb6da7bedf1e3416f2b9a1e80605ca1 [email protected] is a near-empty wrapper index.js exports an empty object whose package.json declares the dependency 'ltidisafe' with the...

MAL-2026-10421 Malicious code in portway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e04dc52cd77658d168578535fb67d77ea76de79beadb77e14c96f023f4e51772 package.json declares the dependency 'ltidisafe' as a direct https tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.2.tgz...

Malicious code in higherlogic-ocfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73e9c228fc5188d602b213f2c6e7f88d6acbb4a9381667b7c33e4cb825aedf2 Package [email protected] is a dependency-confusion lure targeting the Higher Logic vendor namespace. The published index.js is an empty...

CVE-2026-55180

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded $ENVVAR placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim...

MAL-2026-6354 Malicious code in npm-bug-bounty-test1-rhyselsmore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 354a2aa5da5356bab1c97537f865ebdf6af3fcc24f74a6f7c6f78181265c8af2 package.json declares a dependency foo whose source URL is https://3223567a82f3.ngrok.app/foo — an ephemeral, anonymous ngrok tunnel with no version...

Malicious code in via-city-tools-m-particle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc5c4f690e0399edc4408e7729291803db7916ed764bcfe16988f4cdccd5cfc1 The package exports an empty object module.exports = and has no functionality of its own. Its only substantive effect is to declare a dependency on...

Malicious code in corporate-front-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d26a235f294aacb3800465f89db0f33ecb54f09da450ee98543f8b039249fc12 [email protected] is a near-empty shim index.js exports an empty object whose only meaningful content is a tarball-URL dependency declared i...

Malicious code in mazemap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 751317dcad79cec866b8dc69cd60b39e3be8e1bcc45746039835b04ce32445b0 package.json declares its only dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.2.tgz...

Malicious code in @sourceflow-uk/sourceflow-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5bcccc37c380ce54f5bfc2bc2311fbefb6ebc3400a397cbc4afc2188fb3c11d package.json declares a dependency ltidisafe whose version specifier is the raw URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz — a...

CVE-2026-44444 Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan assertSafeBackendBundle. A malicious extension that ships a package.json with a preinstall,...

CVE-2026-44444 Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan assertSafeBackendBundle. A malicious extension that ships a package.json with a preinstall,...