Malicious code in chaienv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbb73465123d4e732dae815badc8950b40e9447463c1fca697551ab3aa00e020 [email protected] is published as a small Chai environment helper, but its index.js unconditionally loads lib/config.js at require time via const config ...

MAL-2026-17316 Malicious code in booking-eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs Windows Script Host against a .vbs file on npm install. The...

Malicious code in json-bigint-rs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module...

MAL-2026-17312 Malicious code in json-bigint-rs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module...

MAL-2026-17314 Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

MAL-2026-17305 Malicious code in esm-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke...

Malicious code in esm-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke...

MAL-2026-17309 Malicious code in stestenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee35b23a60484ee1d468154734cc7cdbc8c7d3cbc81901ab680cb67e46a8c2b6 On require of the package's main entry, dispatchAnalytics reads a payload hidden in the JPEG APP13 marker 0xFFED segment of the bundled dist/stest.jp...

MAL-2026-17302 Malicious code in solidity-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB...

MAL-2026-17303 Malicious code in web-vitals-polyfill-core-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload...

MAL-2026-17297 Malicious code in test-agency-assignment-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9944ea8ca21c0670c4b718a12427e8ca7330571ef5a9198a60b05f75038fe73 The tarball contains only package.json and 4444.vbs; the declared main entry index.js is absent. package.json defines a postinstall script wscript.ex...

MAL-2026-17299 Malicious code in testosu8887 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9d3296b770afd3fdebaf4df9d113873e9c77d2d498d2e7941a3465eeb6f97d On require or CLI invocation, dist/index.cjs and dist/cli.cjs call a top-level function dispatchAnalytics, invoked via he/Re that reads a bundled ima...

Malicious code in testosu888 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27 On loading dist/index.cjs main entry and on running the dot2env CLI dist/cli.cjs, the package invokes a dispatchAnalytics routine that reads...

MAL-2026-17298 Malicious code in testosu888 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27 On loading dist/index.cjs main entry and on running the dot2env CLI dist/cli.cjs, the package invokes a dispatchAnalytics routine that reads...

MAL-2026-17293 Malicious code in @selfpentest/eslint-pentest-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f338876601180482b20a42fbd799b9d4e1b059bf7d733b5db448f7fc6d3455ff Package presents itself as an ESLint plugin but the exported plugin object is an empty shell. index.js unconditionally invokes a steal routine at top...

MAL-2026-17292 Malicious code in @selfpentest/bin-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3 package.json registers a bin entry named npm pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a...

Malicious code in @selfpentest/bin-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3 package.json registers a bin entry named npm pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a...

Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc8739717b3768c51a56da3a23b85b253b0bc08a2ab4a447e278d055c8a2e70 This package presents itself as a fork of the Baileys WhatsApp library. On every successful login through makeWASocket, lib/Socket/socket.js invokes...

MAL-2026-17287 Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc8739717b3768c51a56da3a23b85b253b0bc08a2ab4a447e278d055c8a2e70 This package presents itself as a fork of the Baileys WhatsApp library. On every successful login through makeWASocket, lib/Socket/socket.js invokes...