MAL-2026-17302 Malicious code in solidity-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB...

MAL-2026-17303 Malicious code in web-vitals-polyfill-core-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload...

MAL-2026-17297 Malicious code in test-agency-assignment-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9944ea8ca21c0670c4b718a12427e8ca7330571ef5a9198a60b05f75038fe73 The tarball contains only package.json and 4444.vbs; the declared main entry index.js is absent. package.json defines a postinstall script wscript.ex...

MAL-2026-17299 Malicious code in testosu8887 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9d3296b770afd3fdebaf4df9d113873e9c77d2d498d2e7941a3465eeb6f97d On require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function dispatchAnalytics, invoked via he/Re that reads a bundled ima...

Malicious code in testosu888 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27 On loading dist/index.cjs main entry and on running the dot2env CLI dist/cli.cjs, the package invokes a dispatchAnalytics routine that reads...

MAL-2026-17298 Malicious code in testosu888 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27 On loading dist/index.cjs main entry and on running the dot2env CLI dist/cli.cjs, the package invokes a dispatchAnalytics routine that reads...

MAL-2026-17293 Malicious code in @selfpentest/eslint-pentest-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f338876601180482b20a42fbd799b9d4e1b059bf7d733b5db448f7fc6d3455ff Package presents itself as an ESLint plugin but the exported plugin object is an empty shell. index.js unconditionally invokes a steal routine at top...

Malicious code in @selfpentest/bin-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3 package.json registers a bin entry named npm pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a...

MAL-2026-17292 Malicious code in @selfpentest/bin-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3 package.json registers a bin entry named npm pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a...

Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d06d6b516b21b0ac6ed45e5653dca243695a2c17326669ec58498e4c9bcf45 package.json declares the runtime dependency libsignal with the value github:chatunitycenter/libsignal-node, an off-registry git source with no commi...

MAL-2026-17287 Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d06d6b516b21b0ac6ed45e5653dca243695a2c17326669ec58498e4c9bcf45 package.json declares the runtime dependency libsignal with the value github:chatunitycenter/libsignal-node, an off-registry git source with no commi...

MAL-2026-17285 Malicious code in @akapaki/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14fdf44df68d2544cc235039ef40a99c7df7bcbfc968e8d5809762031f0dd16 @akapaki/[email protected] is an unofficial republish of the Baileys WhatsApp library under a new scope author paki, empty README, repository...

Malicious code in @akapaki/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14fdf44df68d2544cc235039ef40a99c7df7bcbfc968e8d5809762031f0dd16 @akapaki/[email protected] is an unofficial republish of the Baileys WhatsApp library under a new scope author paki, empty README, repository...

MAL-2026-17286 Malicious code in queeuees (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0 Obfuscated code iterates over files in the system and adds a comment to every .py file found. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-17306 Malicious code in fabric-loader-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...

Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17284 Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17283 Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17282 Malicious code in @hrmony/hyper-json-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8139053048172994cadd0251ef74e5104c489dcb4f0448153ea9342b3feb707 On module load, index.js performs top-level fetch to a hardcoded attacker-controlled endpoint at...