Malicious code in @heartlandone-private/fontawesome-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b5bd52805195c9e3575760b3eaf605a2b9cb0fcbdde2311b7075d2d8095c4900 The OpenSSF Package Analysis project identified '@heartlandone-private/fontawesome-pro' @ 6.3.3 npm as malicious. It is considered malicious...

MAL-2026-11000 Malicious code in application-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07fa5354b40e3efac6ff8738892aa26cb710e6aff3caca516f563502ef4a4d43 On npm install, scripts.postinstall runs test.js which performs three attacker-beneficial actions against the installer's host. 1 Backdoor: fetches a...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4618cc8c89ff606f81079aef2e98920220ca9e59ec284c8d6c18167208604a3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10797 Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-de (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e285fcafad462340d980568e8c345cbc9e879d2d9ee5cb2c61fb46a97e6de73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10802 Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-3-0-de (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68161a49a3b8e2933eedf9545f29048260a979f1a2c77dde57c806c9ec7d0179 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10945 Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

MAL-2026-10936 Malicious code in twilio-platform-request (npm)

The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a private...

MAL-2026-10708 Malicious code in @aicommander/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a0d4917f10db91a59e47821bfa2399801219a85da0a59b8596d85fd3931fc93 @aicommander/agent installs a remote-machine agent that opens an outbound WebSocket to the hardcoded relay https://aicommander.dev and executes shell...

MAL-2026-10724 Malicious code in @yuandc/aica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9352926e7ceab9460eb3fecae1dfd1bcb9417efa9488e6f7f858149a47e1f31 Package runs a persistent worker invoked via the aica start CLI that long-polls the hardcoded endpoint https://aca.kinghon.com.cn:8843/ for three...

MAL-2026-10740 Malicious code in myreviews-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c41d5d4352e265f0efbc0089a19c5773ceeb76c0265831eeeeca19151fe4f64 package.json declares a postinstall lifecycle hook that runs node -e to issue an HTTPS GET to a hardcoded webhook.site collector URL, appending the...

MAL-2026-10615 Malicious code in smb-common-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66072ca2fc20c19a01d0a2b888d90632a7d9bfdc34a2d1a71b61ad06975eae5c package.json declares a preinstall hook that runs index.js. On npm install, index.js collects host reconnaissance from the installer os.hostname,...

MAL-2026-10530 Malicious code in cbr-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7 On module load, the package's main entrypoint shells out via childprocess.exec to run cat /etc/passwd and prints the contents to stdout. This fires...

MAL-2026-10542 Malicious code in skrill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4219c6698feb94554982491eef6e0cc533353d46c42e4a7c8679ace1264602 Package published as 'skrill' with description 'Skrill API wrapper' and repository 'github.com/paysafe/skrill' impersonates the Skrill Paysafe paymen...

MAL-2026-10510 Malicious code in type-astr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89817054cec44ec8ba09dd26af025483096055c0a931172bd4a63910dceb87fc The package presents itself as a pino-compatible logger exports a middleware aliased as pino, ships pino-like files such as proto.js, redaction.js,...

MAL-2026-10511 Malicious code in type-swap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db27d60a7dec38dafef8ed810203dc0130cf340eae162410dfcb7b21a4e2658 The package's declared main entry index.js exports a middleware factory that, when invoked by a consumer, spawns lib/caller.js as a detached child...

MAL-2026-10509 Malicious code in test_adminet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1971734ce6221624b53d3647a5881c1fe0bc7f8ae4d383a5ff2a9f5080da57c The package's package.json declares a preinstall hook that runs index.js. On npm install, index.js uses childprocess.exec to curl-POST installer...

MAL-2026-10486 Malicious code in @omniwatch-wick/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77b823fd6a050959af05f24e75f87cad447ab83a65c31349c7a559502af278c index.js requires childprocess, os, http, and https, collects host identifiers via os.userInfo, hostname, and process.platform, and POSTs the collect...

MAL-2026-10473 Malicious code in claude-team-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e9f6179a67a2904c37bd9cff22174a8c57755972fc878047993c35c03f5544 On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with the real terminal attached...

MAL-2026-10456 Malicious code in @spzhongwin/skill-logger-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970980f38a6389d5b622ca41ba3b418f1538b2a38f595536c97acb934012b8b9 The package advertises itself as a skill usage/error logger but, when activated via the openclaw gatewaystart hook, opens a persistent WebSocket to a...