MAL-2026-13629 Malicious code in @coralxyz/anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763 Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor hyphen removed. The npm postinstall hook,...

MAL-2026-13662 Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...

Malicious code in @depup/astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7c6330072ae71974da0dd2e0e72a33334a35b78ec5679536d95b9f205032225 This package is published under the @depup scope but sets author to 'withastro' and repository to github.com/withastro/astro, framing itself as a...

Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

MAL-2026-13540 Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints...

MAL-2026-13531 Malicious code in damir-cbr-dawdntrnssbf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f On require of the package, polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts...

Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

Malicious code in bigops-abstract-entity-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 294402f19750cb519f7bdcf28e24e057513e0fc59cbfa4bc8e24a39b93832351 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific asset path, downloads bytes from a rotating list of...

MAL-2026-13550 Malicious code in dolyame-boxy-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0 On require of the package, index.js loads bridge.js which unconditionally executes a setup routine that downloads a platform-specific executable from...

Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

MAL-2026-13447 Malicious code in gpt-terminal-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached...

Malicious code in app-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2be81204ed300a759662ca3315431eec9dbb11392232f04cc58d1a815fb94b4 On npm install, scripts.postinstall executes test.js, which performs three attacker-beneficial actions against the installer's host. First, it...

MAL-2026-13226 Malicious code in bigops-nitro-events-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d222994e1816e63b4047f5396bbfda8d6d2ccd6bbc840da4872aa026f879525 The package's index.js requires./shim on load. shim.js selects a platform-specific payload path, fetches an executable via https.get from one of thre...

Malicious code in bigops-storio-store-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from...

Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...

MAL-2026-13275 Malicious code in devplatform-zod-wip-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492 [email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally...

Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirror...