MAL-2026-12698 Malicious code in devplatform-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626 Requiring devplatform-auth-client loads bootstrap.js, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded...

Malicious code in devplatform-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626 Requiring devplatform-auth-client loads bootstrap.js, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded...

Malicious code in devplatform-spa-plugin-root-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...

Malicious code in chai-as-inspired (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4795830ed2849aaf2a6eaa488fbecc42a31c2d6d212fe34e635c16217e46ed chai-as-inspired is a typosquat resembling chai/pino packages. Its middleware entrypoint index.js spawns a detached node lib/caller.js child on...

Malicious code in tick-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint http://31.97.137.157:45000/icons/107 and passes the returned...

MAL-2026-12386 Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

@ccfly/setup (0.1.15) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.15)

@ccfly/setup-darwin-x64 NPM version 0.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.15 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.16) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.16)

@ccfly/setup-darwin-x64 NPM version 0.1.16 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.16 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.1) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.1)

@ccfly/setup-darwin-x64 NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.9) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.9)

@ccfly/setup-darwin-x64 NPM version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.9 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.6) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.6)

@ccfly/setup-darwin-x64 NPM version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.8) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.8)

@ccfly/setup-darwin-x64 NPM version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.8 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.13) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.13)

@ccfly/setup-darwin-x64 NPM version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.13 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@ccfly/setup (0.1.3) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.3)

@ccfly/setup-darwin-x64 NPM version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

new-native-tools (>=3.1.43-as2-9980-421-1785848450, <=3.1.43) potentially affected by unknown CVE via new-native-tools-linux-x64-gnu (3.1.43)

new-native-tools-linux-x64-gnu NPM version 3.1.43 is affected by a known vulnerability. The following packages have a transitive dependency on new-native-tools-linux-x64-gnu and may be impacted: - new-native-tools =3.1.43-as2-9980-421-1785848450, =3.1.43 Source cves: unknown CVE Source advisory:...

Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

MAL-2026-12464 Malicious code in streak-daybucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 799caca8e351ad8d1144b26eb0c38ffdf06afb415f63a320e6ea455968996aa0 [email protected] presents itself as a day-bucket / streak math utility but its index.mjs embeds a hex-encoded Windows PE binary leading 4D5A90...

Malicious code in hubert-document-actual-insurance-rules-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc On require of the package, index.js loads helpers.js which downloads a platform-specific executable from a rotating list of Cloudflare Workers hosts...

Malicious code in dolyame-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5714ca0e12469cd96b5fef550b4f9715da5b806e8bd365ecfbea757c3f05f73e On require of the package, index.js loads bootstrap.js inside a swallowed try/catch. bootstrap.js selects a per-OS/arch payload path and downloads...

Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...