MAL-2026-2389 Malicious code in spectral-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b458f8a3676b73711c711d763768712cc0bf1f7fb7233a87fb8b5817b7c509c The package spectral-module was found to contain malicious code...

MAL-2026-2373 Malicious code in my-little-durgham (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebd82bcebf08ed109a462bd365260e6e503b9e10c3645cf696f863a23b4f3614 The package my-little-durgham was found to contain malicious code...

MAL-2026-2369 Malicious code in loadshh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d004f6eea15c013bd06ee8a4dd18dff1443aacb9ced1b110a7d05f59bc5438 The package loadshh was found to contain malicious code...

MAL-2026-2363 Malicious code in env-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b65432f04e2d76673de1e30fd9afbce2259306e45f6590848f02eb6f72535333 The package env-extend was found to contain malicious code...

MAL-2026-2339 Malicious code in chai-as-chains (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abf6eaadbaedff56f824c4c68f8af9138c01d40189e0225051d35c52dee1adc9 The package chai-as-chains was found to contain malicious code...

MAL-2026-2337 Malicious code in chai-as-aligned (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bfc79b3c746510178bdaa8e79ecf903f3705e61a09a5846e263159301607f91 The package chai-as-aligned was found to contain malicious code...

MAL-2026-2336 Malicious code in cdnjavacss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fb57ffd656f0a20fd4da4f7364cf96e67191700bda0682462b0ea9c68de1bb1 The package cdnjavacss was found to contain malicious code...

Two litellm versions published containing credential harvesting malware

After an API Token exposure from an exploited Trivy dependency,two new releases of litellm were uploaded to PyPI containing automatically activated malware,harvesting sensitive credentials and files, and exfiltrating to a remote API.The malicious code runs during importing any module from the...

PYSEC-2026-2 Two litellm versions published containing credential harvesting malware

After an API Token exposure from an exploited Trivy dependency, two new releases of litellm were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. The malicious code runs during importing any module from the...

MAL-2026-2332 Malicious code in @hsbc-mfe/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a848d447b30dd51c4c541fa6a6e6d377bfe77ee4b04b4904996f725b8519789 The package @hsbc-mfe/host was found to contain malicious code...

MAL-2026-2129 Malicious code in express-session-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3beac16c32c8776482bafbb2ad95b50b7b18bf6e93fbf712238f60a4d7ae363d The package express-session-validator was found to contain malicious code. Source: ghsa-malware...

Malicious code in sbx-mask (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 199f83840bd0dfd9d9e7295134e439e8adec273f9be8477d0ff68b6ec8c491d1 The package sbx-mask was found to contain malicious code. Source: ghsa-malware d04d541813f3f1e2bd2d1c509c5ea3463d64caf433617ab3398e118171f2cc65 Any...

Malicious code in fancode-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56c163153700b6fef7090e078a98b7c2403088e5c5f487344dc419af8adaa7 The package fancode-web-app was found to contain malicious code. Source: ghsa-malware a933e6c673f3cf2c4cb0e768570b64dcf627ac59e6b29c2e9afd5a5fb3d4396...

MAL-2026-2136 Malicious code in yelp-react-component-rating (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027bbca928c4c1696f388fbb2ac0ac3a7c74a29db1a6bb76b5c7431759c27421 The package yelp-react-component-rating was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2126 Malicious code in agoda-dep-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faa0bc71a76133f8ba2469aab72a42ed605c22eaf6a3816754f5dff2cb21fa87 The package agoda-dep-confusion was found to contain malicious code. Source: ghsa-malware...

Malicious code in yelp-biz-action-constants-js-generated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063bb3466bef20db9d0f0c8436b384fe8b498ccceef3993ab43e0482b43efc40 The package yelp-biz-action-constants-js-generated was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2131 Malicious code in nemo-fpti (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d59bda0a25d9b656075c91322ff0c7a8463b743465176a358265f7fb35710b98 The package nemo-fpti was found to contain malicious code. Source: ghsa-malware 7e5357f25ae0271690f061e93dc85be49cf6ebe3ccd0d09110524b0fcbb30ee3 Any...

MAL-2026-2133 Malicious code in server-fpti (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b90fb70466093bba29ed5b8f62a9734b95ff7011add06482beec9546984f11c3 The package server-fpti was found to contain malicious code. Source: ghsa-malware 59d0d75db844e966a9f5cc0e311ca6f2385abdf95ca0ee2387c23be8342f0fb2 An...

MAL-2026-2418 Malicious code in tombac-chronos (npm)

Suspicious install script executing index.js and an untrustworthy author email domain sl4x0.xyz strongly suggest this package is malware. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69e040ef4bdedbed143a5a8d1a1bb0389fa07848772a87c03da1c67557ced13e The package...

Malicious code in cr-static-shared-components (npm)

Malicious package due to code obfuscation, dynamic module loading, suspicious email, and arbitrary code execution during installation. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcc8531926534d3d87af7c173bfaba5f563bdbbc6ae8293de0150a0f00ba205 The package...