MAL-2026-10081 Malicious code in webrix-docs1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20cdefe1415c5b5245f36b10ea0de9033433b479768c2cc785ad2742b9433fce The package declares a preinstall hook node index.js that fires automatically on npm install. The script requires childprocess, os, https, and http,...

MAL-2026-10080 Malicious code in webrix-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host reconnaissance data — os.hostname,...

MAL-2026-10079 Malicious code in vybscan-testbed-obfuscated-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9aee5b150e0606b1c5c2469fdab43496965a3dd5664df288d68d618e326567 package.json declares a postinstall lifecycle script that runs node -e "evalBuffer.from'','base64'.toString". Installing the package triggers executi...

Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

Malicious code in ts-eslint-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1ffed26d2d64bf9076210504de22b87e27a065821dedbc708fb05f7c47db74 The package [email protected] presents as a TypeScript/ESLint/Jest helper but ships lib/collect.js, which imports childprocess and invokes...

Malicious code in chai-as-modified (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab841cd3ab01bfcd1257a214489b41f10e236779e236a0672642777160245a9e Package name is a 1-2 character variant of the widely-used chai-as-promised plugin. The exported function — the entry point users pass to chai.use...

MAL-2026-10043 Malicious code in chai-as-modified (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab841cd3ab01bfcd1257a214489b41f10e236779e236a0672642777160245a9e Package name is a 1-2 character variant of the widely-used chai-as-promised plugin. The exported function — the entry point users pass to chai.use...

MAL-2026-10049 Malicious code in chai-await-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js...

MAL-2026-10047 Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

MAL-2026-10052 Malicious code in chai-promised-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ddaac3e93ed2e5d968816cf3153b2ab1878580bb9ee65ec3ec1acdca41dc018 Package masquerades as a chai-as-promised plugin / pino logger README and exports copied from pino, including module.exports.pino = middleware but on...

Malicious code in chain-chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with...

MAL-2026-10056 Malicious code in chain-chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with...

MAL-2026-10048 Malicious code in chai-as-thread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69f1826d6866410cdfe11e20cff630d3f0118d48c0cc9f697297aa64d29b341 On require, the package spawns a detached node child that runs lib/initializeCaller.js. That script decodes a base64-obscured URL...

Malicious code in chai-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28e7b8eaee41f8a9717775967be05791e0daf3f5f3e5070ac28c6a2f544fcc02 The package presents a pino-like logger API but its exported middleware spawns a detached node child process running lib/initializeCaller.js. That...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18972 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +179 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.0-beta.1, <=2.2.2)

body-parser NPM version =2.0.0-beta.1, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =1.0.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =3.9.1 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

Malicious code in chain-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc73eb727778c3a543bdef1f6993d4c8be38da047fc97b7a0614bd195590249 chain-api-sdk presents itself as the upstream multichain-crypto-wallet library: README, badges, package.json repository.url, and homepage all point t...

MAL-2026-10009 Malicious code in chain-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc73eb727778c3a543bdef1f6993d4c8be38da047fc97b7a0614bd195590249 chain-api-sdk presents itself as the upstream multichain-crypto-wallet library: README, badges, package.json repository.url, and homepage all point t...

MAL-2026-10012 Malicious code in mchain-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5249b7e6ec4cba8f4a3b2d332ec69069c1ca39eabec04a1372500ea25952280 package.json declares a postinstall hook node./src/core/index.js. That module immediately runs a top-level async IIFE that base64-decodes a URL store...