MAL-2026-17849 Malicious code in brass-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ab25e940e6abf9009b89e6480c744db72c4ea0be4d83d095ead744e83055b7cf The OpenSSF Package Analysis project identified 'brass-common' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in react-dropzone-v4 (npm)

Source: ossf-package-analysis a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b The OpenSSF Package Analysis project identified 'react-dropzone-v4' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in react-dropzone-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of...

MAL-2026-17758 Malicious code in react-dropzone-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of...

Malicious code in @library-wide/library-shell (npm)

Source: ossf-package-analysis 40f52e7af5c6b8f0c78b5100b561b799fc6acd9fa9c5372982a14bb5c1b42da1 The OpenSSF Package Analysis project identified '@library-wide/library-shell' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

MAL-2026-17754 Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

Malicious code in kmf-i18n (npm)

Source: ossf-package-analysis c506e33bdce28606141b7d2bbebbae50e97e466ab04664a9cca8fa48a3622ae1 The OpenSSF Package Analysis project identified 'kmf-i18n' @ 100.100.102 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in test-account-portal-fe (npm)

Source: ossf-package-analysis 5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907 The OpenSSF Package Analysis project identified 'test-account-portal-fe' @ 100.100.102 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in @myorder-frontend-commons/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to...

MAL-2026-17749 Malicious code in @myorder-frontend-commons/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to...

MAL-2026-17748 Malicious code in test-account-portal-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca npm package [email protected] ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally fro...

MAL-2026-17746 Malicious code in kmf-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74 On npm install, the package's postinstall script performs two exfiltration actions. First, it reads the installer's hostname and npmpackagename and...

Malicious code in kmf-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74 On npm install, the package's postinstall script performs two exfiltration actions. First, it reads the installer's hostname and npmpackagename and...

Malicious code in kmf-vendor-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6e1c289f2890e0e06ab31a8d6cf5dbc8deabc26054cb44a0c60295c29a74506 [email protected] is a dependency-confusion lure. package.json declares postinstall: node postinstall.js, which requires a shipped prebuilt...

Malicious code in @dransay/address-validation (npm)

Source: ossf-package-analysis 82ababa5637b2f53f5087a161eeba1b6ca6ddba6d31ebb7842614bf0da119fa7 The OpenSSF Package Analysis project identified '@dransay/address-validation' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

MAL-2026-17668 Malicious code in @dransay/address-validation (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using t...

Malicious code in @smwebserver/static (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3de0cc583ad7f0166991a10b69426eabbd42d6eaef796e7ea078cf76e9a741e7 The package ships an effectively empty index.js and its only real content is a manifest-level dependency sourced from an arbitrary HTTPS URL rather...

MAL-2026-17456 Malicious code in @smwebserver/static (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3de0cc583ad7f0166991a10b69426eabbd42d6eaef796e7ea078cf76e9a741e7 The package ships an effectively empty index.js and its only real content is a manifest-level dependency sourced from an arbitrary HTTPS URL rather...

MAL-2026-17420 Malicious code in online-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b9cc23b20e29ff5e2382e8812e86048148646c43b844f6f73db4581e790f761 [email protected] is a dependency-confusion squat name claimed at version 99.0.0 with an inert main entry whose preinstall lifecycle script runs...