Malicious code in ccxt-trading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8 Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through...

Malicious code in william-data-formatter-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df0b15d8ca8cdfac8baf861a2db501b3b52eb0e41fd44a6690c351bda8c90835 The package declares a preinstall script node index.js that, on Windows, spawns a hidden PowerShell window -WindowStyle Hidden to fetch...

Malicious code in pfp-block-mobile-steps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4b4495333f6f37664594f2e6533842a4d3a317bb98bbc3a467797bb8ec851d7 On require of the package, index.js unconditionally loads shim.js, which selects a payload path based on process.platform/arch linuxx64, linuxarm64,...

MAL-2026-12410 Malicious code in pfp-block-mobile-steps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4b4495333f6f37664594f2e6533842a4d3a317bb98bbc3a467797bb8ec851d7 On require of the package, index.js unconditionally loads shim.js, which selects a payload path based on process.platform/arch linuxx64, linuxarm64,...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

Malicious code in tt-help-cli-ycl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6 The package's tt-help watchdog subcommand starts a long-running agent that POSTs heartbeats to a remote server default hardcoded to...

MAL-2026-12488 Malicious code in tt-help-cli-ycl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6 The package's tt-help watchdog subcommand starts a long-running agent that POSTs heartbeats to a remote server default hardcoded to...

ROOT-APP-NPM-AIKIDO-2026-10469 AIKIDO-2026-10469 in knex - Patched by Root

Root has patched AIKIDO-2026-10469 in the knex package for Root:npm. Multiple fixed versions available...

01-dev (1.0.0), 04-musicplayer (1.0.0) +1339 more potentially affected by CVE-2026-71215 via art-template (>=2.0.2, <=4.13.4)

art-template NPM version =2.0.2, =1.0.0, =0.0.1, =1.0.0, =0.0.1-alpha.1, =1.0.2-alpha.3, =1.0.0-alpha.1, =1.0.3-alpha.3, =1.1.4-alpha.1, =1.0.0-alpha.1, =0.1.0-alpha.1, =0.0.1-alpha.1, =0.0.2-alpha.13 and more Source cves: CVE-2026-71215 Source advisory: SNYK:JS-ARTTEMPLATE-18533449...

Malicious code in pfp-integration-mobile-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3428631054a61f4fd2a14f372d7c782dd08633446897b0ee0959d259496d170 On require of the package, bootstrap.js selects a platform-specific binary path, downloads an opaque executable over HTTPS from a rotating list of...

MAL-2026-12209 Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...

MAL-2026-12181 Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

MAL-2026-12224 Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

MAL-2026-12288 Malicious code in twork-data-services-aggregator-sme-task-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7847fa8341bf64260b2ff25824d2dbb7b80f637d77578db5604ea7ab39ea2874 On require of this package, index.js loads runtime.js which asynchronously fetches a platform-specific binary from string-concatenation-obfuscated...

Malicious code in twork-data-services-aggregator-company-sme-main-timeline-loader-with-customers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401d167bfbb3ec350a033f908aef6678495563e92c6b090d0eaab85bd1c2b7ba On require, index.js loads bridge.js which assembles obfuscated Cloudflare Workers hostnames from split string literals...

Malicious code in twork-data-services-product-design-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a86edfca41ff32a7b044ecb921977944dbdc5cf5d2a3ccae4e5ca001a851816 On require of the package's main module, loader.js downloads a platform-specific binary from a set of obfuscated Cloudflare Workers subdomains...

MAL-2026-12301 Malicious code in twork-data-services-sme-agent-company-relation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967bdfae105295a824e45402395d3b82a515d225081bc94f4d5998b2884df38 index.js unconditionally requires./init on module load. init.js assembles host names at runtime via array join to hide them from static scanners, the...

Malicious code in twork-data-services-role-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc0980e765a4c7250c1ac7ca327daefbe85544498883193c5f5019b08c06b8ec On require, index.js loads init.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts assembled via split-string...

MAL-2026-12298 Malicious code in twork-data-services-proxy-invest-symbols-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc81e5181d9c63254883ad238b48528c69f67f901daa5876684cc7490de64356 On require of this package, index.js loads init.js which immediately downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...