MAL-2026-15915 Malicious code in text-transform-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efed1eeb185e17a51a67059e57156e5c540899e5a30076df710e0242a5560c The package's postinstall script downloads a ZIP archive from a hardcoded Dropbox URL https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip ...

Malicious code in text-transform-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efed1eeb185e17a51a67059e57156e5c540899e5a30076df710e0242a5560c The package's postinstall script downloads a ZIP archive from a hardcoded Dropbox URL https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip ...

Malicious code in xcryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 989e6d862a8e433df7f0bd31ab9a6b76f616273783517c81f5e428ad2774ad4e The package declares a postinstall script scripts/install.js that on npm install downloads a ZIP archive from...

MAL-2026-15910 Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...

Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...

MAL-2026-15905 Malicious code in tailwindcss-3d-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6afb2de10208993a1e7511cb81a6f11806561b389673da3fa24d22598178b744 The package's main entry point fetches a JavaScript file from http://23.27.245.100:3000/index.js over plain HTTP at require time, writes the response...

MAL-2026-15897 Malicious code in easypanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cb013a465c19126feba2006a81f33d65cc64b269e3da8ffe4e8284c7defa3cc easypanel-core ships an inert module.exports = main and places all functionality in a preinstall lifecycle script. On npm install, preinstall.js...

MAL-2026-15906 Malicious code in tailwindcss-animate-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c51002139fd978b564f7449840b2aafe85ba738c2e392f497f44951070f3643c On require of tailwindcss-animate-styles, index.js runs evalatob... on a payload appended to the Tailwind plugin. The decoded loader queries public...

MAL-2026-15902 Malicious code in peertube-plugin-video-views-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde plugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'...

Malicious code in peertube-plugin-video-views-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62f93ab1a8cfa1b153c8075e6463d3351c16a49779615556c7ee2fc909fdcde plugin.js contains a top-level IIFE that spawns bash with a /dev/tcp reverse-shell loop to the hardcoded host 45.137.222.44:4444, detached and unref'...

MAL-2026-15904 Malicious code in tailwind-scrollbar-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c9c5760f878552d4d2aedb3afc283b64ba99e65acf1e086158afe79a0267ada dist/index.js exports a small tailwind plugin and then runs evalatob"Z2x..." on an embedded base64 blob at module load time. The decoded loader queri...

Malicious code in tiny-folder-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb7707665659f287294c31f37c4eff9ceba537e9b54859837615929c296a9540 [email protected] declares a postinstall script src/build.js that runs on npm install. The script performs a DNS TXT lookup for...

MAL-2026-15903 Malicious code in tailwind-container-queries (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...

MAL-2026-15900 Malicious code in hydration-ui-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d848dd11c0e0692f1f47c8fcb3cb0506316e96ab32f8b63a8913ad67e9570318 Package main dist/index.mjs locates dist/internal/mathcalc.mjs — a raw x8664 ELF binary shipped under an.mjs extension and described in the README as...

MAL-2026-15871 Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

MAL-2026-15869 Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

MAL-2026-15866 Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

MAL-2026-15868 Malicious code in @bx-ui-framework/microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30 package.json declares a runtime dependency microfrontend whose source is a bare HTTPS URL at...

MAL-2026-15867 Malicious code in @bx-ui-framework/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b8886bf47df30ba72e888647d651e72defd41c1172a4307c438562183d7a32 package.json declares a dependency whose key equals the package's own name @bx-ui-framework/common and whose value is a bare HTTPS URL...