MAL-2026-10178 Malicious code in @broadpeak/smartlib-ad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45df33d93645560085a7efe94308b0e3d846f30c829f2d2804bcdb1245626289 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js loads childprocess/os/https, runs whoami and id,...

MAL-2026-10175 Malicious code in chai-as-doc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecfd3091225b3667317dd9da8fd56c4f5e7fc675e17d52cda601898b3a50ec2 The package presents itself as pino-style logging middleware but on require spawns a detached Node child that runs lib/initializeCaller.js. That scri...

Malicious code in type-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d064750b4e3821d296d538ea749483e3f9cd54299645fc1c895e5c1af3639b5d The package presents itself as pino typosquat; README mirrors pino. The main entry index.js exports a middleware factory that, on invocation, spawns...

MAL-2026-10158 Malicious code in notify-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25536516e16cffdc7ad2891886d7dcf32ad325b9ba79c2359026809bcfbf417f Package published as notify-utilities masquerades as the pino logger package.json description, keywords, and index.d.ts are copied from pino; the...

Malicious code in react-jsonwebtoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b46ca6ae72ce6f079c34ec6d1d1d2be46b36fe429374393f0fe57539fe56ee3 Package name mimics the widely-used 'jsonwebtoken' library and falsely declares 'auth0' as author, while the repository URL points to the unrelated...

Malicious code in type-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37979cc60cff25e26406f3426f0dd7aeac12c13e55402c89f78228080cac0ad9 The package advertises itself as a pino-style logger but its exported middleware spawns lib/caller.js as a detached Node child process. lib/caller.js...

Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ab15ed01b9b4270e5605dcbb6ab8185f8b3501615c5f122a82d41deb14a7bff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10066 Malicious code in nps-retrieval-diagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9521917c225941dd1bfc038c4f324d24ebb9d99b99596e8a481558da10a0df The package's bin entry retrieval-diagnostics installs an attacker-controlled persistence footprint on the host when invoked. It appends a crontab...

Malicious code in chai-promised-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ddaac3e93ed2e5d968816cf3153b2ab1878580bb9ee65ec3ec1acdca41dc018 Package masquerades as a chai-as-promised plugin / pino logger README and exports copied from pino, including module.exports.pino = middleware but on...

Malicious code in @wagni_bot/polygon (npm)

The npm package @wagnibot/polygon is a supply-chain credential stealer disguised as a Polygon SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/binance-sdk (npm)

The npm package @wagnibot/binance-sdk is a supply-chain credential stealer disguised as a Binance SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-10036 Malicious code in @wagni_bot/web3-agent (npm)

The npm package @wagnibot/web3-agent is a supply-chain credential stealer disguised as a web3.js SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-6999 Malicious code in luludawang-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae96a2ee83d724de0e046dbf9e4749e9fd0d5c56fc16f2f28050512080f30628 On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL...

Malicious code in paperclip-adapter-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d49d1a6c5381f58370cbfedc2321bd44796eb4ea79541d967a661760d9759801 [email protected] executes a credential-theft and C2 backdoor automatically on import. The package's main re-exports...

Malicious Package

Overview @gleamkit/probe is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

MAL-2026-6784 Malicious code in @marketfront/livestreampreviewpopup (npm)

The @marketfront/livestreampreviewpopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0...

Malicious code in polymarket-trading-developer-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...

MAL-2026-6720 Malicious code in ts-elinter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767 On npm install, the package's postinstall script scripts/install-check.cjs fetches a JSON pointer from...

MAL-2026-6700 Malicious code in module-index-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on npm install...

MAL-2026-6567 Malicious code in eslint-commit-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fc51e200a141d1dbbb4f7eb9e5e3dec18507572e5dc9562278713c554fad195 The package is published under the name eslint-commit-parser but its contents are a verbatim copy of the supertest HTTP-testing library — package.jso...