MAL-2026-13831 Malicious code in noxleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d929b8d2b0bb5277fede1759081c008d05ea8057d8263c6148e7d61001095a This package is a fork of the Baileys WhatsApp library that wires an undocumented routine into the connection lifecycle. On every WhatsApp...

Malicious code in kanyut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75dd1fedbe6fa65ad732715731698661fbe733cc186c28634d4f0424284dcbe7 A a static rule matched on keyword co-occurrence ping, GET, id across widely separated lines in lib/Utils/generics.js. The matched tokens are...

Malicious code in noxleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d929b8d2b0bb5277fede1759081c008d05ea8057d8263c6148e7d61001095a This package is a fork of the Baileys WhatsApp library that wires an undocumented routine into the connection lifecycle. On every WhatsApp...

MAL-2026-13819 Malicious code in kanyut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75dd1fedbe6fa65ad732715731698661fbe733cc186c28634d4f0424284dcbe7 A a static rule matched on keyword co-occurrence ping, GET, id across widely separated lines in lib/Utils/generics.js. The matched tokens are...

Malicious code in egair0810 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2778f49499126b52d7dc9bbf728ed62bc8177ea325300c7907f2a4b854436507 The package contains a single index.html file declared as the package main, presenting a fake 'Just a moment...' / Cloudflare Turnstile page with...

Malicious code in egypt0811 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d31e1b5baa802662cbb61387f5c3b759d159e74e8776d9515198db5c168074 The package contains only index.html declared as main with no JavaScript modules, no lifecycle scripts preinstall/install/postinstall, and no bin...

Malicious code in mnteckets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caa458e1b7c6ca828e971aa0dac44b11b2f20aaf55652235ce2a4c5ce1c4fd66 The tarball contains only package.json and index.html. package.json declares no lifecycle scripts preinstall/install/postinstall/prepare and sets mai...

MAL-2026-13826 Malicious code in mobicommn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1fdfcbe5e1e182dcc1972748c2ccb13792e2db392a5404ba08a423b8d184da5 The tarball contains just index.html and package.json main: index.html. index.html mimics a Cloudflare Turnstile challenge and, on the Turnstile...

MAL-2026-13803 Malicious code in dzcvhfruwluwe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94746f13a653388ae268279888acdb3aceabbdbc5c7444e406af0dfb6317a6d9 The package's sole shipped file is index.html, a fake 'Cloudflare Verifying...' page containing an obfuscator.io-style script that reconstructs the U...

MAL-2026-13805 Malicious code in egair0810 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2778f49499126b52d7dc9bbf728ed62bc8177ea325300c7907f2a4b854436507 The package contains a single index.html file declared as the package main, presenting a fake 'Just a moment...' / Cloudflare Turnstile page with...

Malicious code in airdzticket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba6833f6a8babb8f543c0e8aefeb9e2f0a73b14c8e336f1efe4fb3ae5e3d5fe Package airdzticket 1.0.0 contains 2 files and shows no lifecycle scripts, network callbacks, credential access, or code-execution primitives that...

MAL-2026-13782 Malicious code in airdzticket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba6833f6a8babb8f543c0e8aefeb9e2f0a73b14c8e336f1efe4fb3ae5e3d5fe Package airdzticket 1.0.0 contains 2 files and shows no lifecycle scripts, network callbacks, credential access, or code-execution primitives that...

MAL-2026-13823 Malicious code in mnmobicom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 551bd821f3078161e164c495a903b00133be4ef630a3c70e6472a8235df93a3b Package [email protected] was scanned with 2 files and no static or behavioral findings were produced. No lifecycle scripts, no network exfiltration, n...

MAL-2026-13804 Malicious code in dzvchorehui2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20fb64bc6f1d195b61b422e1857f68a4f0d94133d7066d640db696b73a4364f5 The package contains a single HTML file that impersonates a Cloudflare 'Just a moment' challenge screen. An obfuscated inline script hex-named...

MAL-2026-13832 Malicious code in passport811 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e96b8ce5a6dee87674b66e3aad6e3cf750c6e24243dd564922ff7b68be2f48b8 [email protected] contains a single HTML file that impersonates a Cloudflare Turnstile 'Just a moment...' challenge. After the Turnstile callback...

MAL-2026-13806 Malicious code in egypt0811 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d31e1b5baa802662cbb61387f5c3b759d159e74e8776d9515198db5c168074 The package contains only index.html declared as main with no JavaScript modules, no lifecycle scripts preinstall/install/postinstall, and no bin...

MAL-2026-13836 Malicious code in twcvhjlksdmx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60b37bf3e91951e089b31d7aa6d31834fef110ba5bfc1c8c3cb09e701c9c1878 The tarball contains only package.json and index.html. package.json declares no preinstall/install/postinstall/prepare lifecycle hooks and sets main ...

Malicious code in twcvhjlksdmx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60b37bf3e91951e089b31d7aa6d31834fef110ba5bfc1c8c3cb09e701c9c1878 The tarball contains only package.json and index.html. package.json declares no preinstall/install/postinstall/prepare lifecycle hooks and sets main ...

Malicious code in mobicommn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1fdfcbe5e1e182dcc1972748c2ccb13792e2db392a5404ba08a423b8d184da5 The tarball contains just index.html and package.json main: index.html. index.html mimics a Cloudflare Turnstile challenge and, on the Turnstile...

Malicious code in mnmobicom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 551bd821f3078161e164c495a903b00133be4ef630a3c70e6472a8235df93a3b Package [email protected] was scanned with 2 files and no static or behavioral findings were produced. No lifecycle scripts, no network exfiltration, n...