Malicious code in rollup-plugin-polyfill-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...

MAL-2026-11320 Malicious code in imut-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bd7ca3cbe4743cad9e7368e601776bae62d8de0b6439b33a446efba71d12b3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11260 Malicious code in clo2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6105a72b9d9a044230d0d4e787fe819d9f2195a5ec8f652797c02c514c9d40b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in def-open-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2ab83557d19fac6db95041a0557305c6950f0c181a3998767dfaf011fc02c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11012 Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

Malicious code in @gocortexio/npmgremlinbox-ucl-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58e0b7489bb5ef9967ddda5eb651a0a399c73ae03e692909f34f864b189bde46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-qpl-1-0-inria-2004 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 269cfa8afaaef9836a6f0d2f53e1a6e72cfa7a3c466c4831bb5c7269e7d2bf73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10698 Malicious code in websight2-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...

Malicious code in timmytuffknuckles6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22ef6fa6c2b9f80d6a1f79e532a9d9ea083a1c662bc834d118879ba630842b0c This package is not a Node.js library. package.json declares "main": "sw.js", a Service Worker that calls importScripts'./8cfc2/hgshm.js' — an API th...

Malicious code in ishowfeet5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f3dc5dbca240ed6fabdb431e41494dd64100dbf96791921a36642cb53a9403 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-6839 Malicious code in hjs-lint-builders (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0fb723c71ef04ac50fb2126b5a4df175698c4c1a8a782536880c7031406e6bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6506 Malicious code in pump-laserstream-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92a36ce6afdf46f9c63d665ee85ca989b2678feb83e79ff3969c2fb5d1328475 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in data-fetching-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913d882d66d587abb1d6fe92b8b6d7353c1b4ae79fb175cc3f10b606dd5f8457 Package self-identifies in its package.json description as a bug-bounty dependency-confusion proof-of-concept against an internal package name of the...

MAL-2026-6032 Malicious code in @mastra/pinecone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5fe167a290de09771a13ca4a40df0709c0351a576d7515d2279d6697717ce21 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in npmjs-doc-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e75a4fc474b58b6d7226e8448d6c909312baf7aff6e9587188cc56a2a5dface Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bign.tsm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a742cbbbd867c961c2a0d001e20f92dfadd209e9071734e840bbd0e0606d4f6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5846 Malicious code in prettier_v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52d6c46e6d7e7ba0269dbb3d9725b5943d1b4b94ac2587a5738983cb93d8e1cf Package name 'prettierv2' closely resembles the widely-used 'prettier' formatter package, raising typosquat concerns. The file lib/mirror.js contains...

Malicious code in vite-enhancer-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f95dc5a82c03457cbfab461f0b1775f3918589db6ac513342a1ec0dc1aacc1fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5843 Malicious code in chai-smart-assert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c0d75b8077d317728bd396870ad1f297ea11f7a50585421fdf2b888cf3a9f3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5690 Malicious code in ecto-spectral-leak-8d4e2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed80e7979c97935537c82692c1be6aa9fa4880f76b412057e9d8ed7d66af999f On npm install, postinstall.js executes shell commands that enumerate AWS Secrets Manager across regions aws secretsmanager list-secrets followed by...