Malicious code in @platform-services/hrm-mfe-core (npm)

Source: ossf-package-analysis c7552efe145088950a0df7a5c63da92a309a040fba2062a4d32bb59cadc9ec47 The OpenSSF Package Analysis project identified '@platform-services/hrm-mfe-core' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

MAL-2026-18091 Malicious code in @platform-services/hrm-mfe-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6340950b2d19371534634bc33af5c0b785b1fa105a5c1084c5689879c4b03da8 package.json declares a dependency whose key equals the package's own name, @platform-services/hrm-mfe-core, with its source set to the bare URL...

Malicious code in @platform-services/hrm-mfe-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6340950b2d19371534634bc33af5c0b785b1fa105a5c1084c5689879c4b03da8 package.json declares a dependency whose key equals the package's own name, @platform-services/hrm-mfe-core, with its source set to the bare URL...

Malicious code in sc-announcer (npm)

Source: ossf-package-analysis 38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43 The OpenSSF Package Analysis project identified 'sc-announcer' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in ccl-global-shopping (npm)

Source: ossf-package-analysis 31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9 The OpenSSF Package Analysis project identified 'ccl-global-shopping' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in fanarena-common (npm)

Source: ossf-package-analysis d81686cb5b877d15810946a299ba819a875a3304e45d65a3fdb83c5473ac664b The OpenSSF Package Analysis project identified 'fanarena-common' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

MAL-2026-18063 Malicious code in fanarena-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0da88f07c843cff93266258d7d4e30c369b05fb52974170e25abb1e6c33e3c5 package.json declares a dependency ltidisafe sourced directly from the bare HTTPS URL...

Malicious code in fanarena-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0da88f07c843cff93266258d7d4e30c369b05fb52974170e25abb1e6c33e3c5 package.json declares a dependency ltidisafe sourced directly from the bare HTTPS URL...

MAL-2026-18061 Malicious code in ccl-global-shopping (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9 The OpenSSF Package Analysis project identified 'ccl-global-shopping' @ 99.9.1 npm as malicious. It is considered malicious because: - The packa...

MAL-2026-18062 Malicious code in sc-wizard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 54691cc130e614ee031186f7e646c3e6076efad6105a6e9cad68f62aa736516b The OpenSSF Package Analysis project identified 'sc-wizard' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in @fmr-ap149494/apex-base-component (npm)

Source: ossf-package-analysis e3505d2eebf31d1938862b6f6744d353fadaf980b9a27860f2a7c36d863828b9 The OpenSSF Package Analysis project identified '@fmr-ap149494/apex-base-component' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated wit...

Malicious code in @fcsmc/commercial-analytics (npm)

Source: ossf-package-analysis 2a6c1e570c16bbf3b94ecc31e622c4d31be7c8575c90eaffc238ca1ef36e659d The OpenSSF Package Analysis project identified '@fcsmc/commercial-analytics' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in brass-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657abbbfdd17b21af7ad85e8634e0fb2ac36e35c6b95996322f10584ef4c1570 [email protected] declares its only dependency ltidisafe as a direct HTTPS tarball URL...

MAL-2026-17849 Malicious code in brass-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657abbbfdd17b21af7ad85e8634e0fb2ac36e35c6b95996322f10584ef4c1570 [email protected] declares its only dependency ltidisafe as a direct HTTPS tarball URL...

Malicious code in react-dropzone-v4 (npm)

Source: ossf-package-analysis a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b The OpenSSF Package Analysis project identified 'react-dropzone-v4' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in react-dropzone-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of...

MAL-2026-17758 Malicious code in react-dropzone-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of...

Malicious code in @library-wide/library-shell (npm)

Source: ossf-package-analysis 40f52e7af5c6b8f0c78b5100b561b799fc6acd9fa9c5372982a14bb5c1b42da1 The OpenSSF Package Analysis project identified '@library-wide/library-shell' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

MAL-2026-17754 Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...