Malicious code in img-to-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7676788d88c2194b8d5c048decfbe06550798ce342af54f8975bc26422d10c53 On require of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended afte...

MAL-2026-17216 Malicious code in img-to-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7676788d88c2194b8d5c048decfbe06550798ce342af54f8975bc26422d10c53 On require of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended afte...

Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...

Malicious Package

Overview eslint-plugin-skywagon-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview fabric-asset-pipeline is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview simple-date-formatter-new-12 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview azure-langchain-example is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview llm-nebula is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview my-skibidi is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in nebula-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0ca45fda7abd51edfeef37be6d19b4070788180b7625f16354223d81dae4d45 The preinstall.cjs lifecycle script embeds a base64-encoded, zlib-compressed Windows PE 257KB as a string literal. On npm install, the script decodes...

Malicious Package

Overview img-to-native is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17219 Malicious code in nebula-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0ca45fda7abd51edfeef37be6d19b4070788180b7625f16354223d81dae4d45 The preinstall.cjs lifecycle script embeds a base64-encoded, zlib-compressed Windows PE 257KB as a string literal. On npm install, the script decodes...

Malicious Package

Overview figlet-chalk-render is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview nebula-llm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview tailwindcss-form-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview git-en-boite-logging is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview nebulaai-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview nebula-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview fabric-render-bridge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17220 Malicious code in nebulajs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07debd960454b52639fee783e21c0c303702d8dce6de5e3320393f1b0abc7077 package.json declares scripts.preinstall = 'node preinstall.cjs'. preinstall.cjs is a single 232KB opaque Function... invocation containing a custom...