Malicious code in chai-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28e7b8eaee41f8a9717775967be05791e0daf3f5f3e5070ac28c6a2f544fcc02 The package presents a pino-like logger API but its exported middleware spawns a detached node child process running lib/initializeCaller.js. That...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18979 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +179 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.0-beta.1, <=2.2.2)

body-parser NPM version =2.0.0-beta.1, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =1.0.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =3.9.1 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

Malicious code in chain-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc73eb727778c3a543bdef1f6993d4c8be38da047fc97b7a0614bd195590249 chain-api-sdk presents itself as the upstream multichain-crypto-wallet library: README, badges, package.json repository.url, and homepage all point t...

MAL-2026-10009 Malicious code in chain-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc73eb727778c3a543bdef1f6993d4c8be38da047fc97b7a0614bd195590249 chain-api-sdk presents itself as the upstream multichain-crypto-wallet library: README, badges, package.json repository.url, and homepage all point t...

MAL-2026-10012 Malicious code in mchain-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5249b7e6ec4cba8f4a3b2d332ec69069c1ca39eabec04a1372500ea25952280 package.json declares a postinstall hook node./src/core/index.js. That module immediately runs a top-level async IIFE that base64-decodes a URL store...

Malicious code in testing-d3do (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c008bcf9a72a02f11c556396a39d6de999bfad0cfa389ddac01929d19bb34d8 On npm install, this package's postinstall script collects host identifiers os.hostname, os.userInfo, current working directory, and external IPv4...

MAL-2026-10008 Malicious code in breeze-feature-flag-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bc85f58d0fcdcfa75e143c0fb4e09095edf4d9fd3ac6d53576d58176beef49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10018 Malicious code in security-console-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a180b49026fbe4dd5787621d741ec0d6ef2da9a212854a9d5e3cebbdfbb3c0a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10011 Malicious code in fusion-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b340a880ef3177b0632f113a7c619132bf28a0ef5df0eeb076f46b9db17f7b1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10007 Malicious code in bizapi-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3243a0e75a614dce3a4ec14f3d531eb292ed0f9dcb48e09d55367952e6a127d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-7031 Malicious code in clavuepro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97a9e3cf794eb2bc8d9ebb4bab007a52bf9fc1ed9dbc3db19695542503ec253e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-7030 Malicious code in clavue-agent-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 399c0d2f1fabfa46b35810b70797862a0fd469076fa9496549237ab413ccada2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-7032 Malicious code in myclaude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3597c40ce7f730173367aa9f9cc4f29c53af17524c19c4814caafa08cd1b20bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in clavue-agent-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 399c0d2f1fabfa46b35810b70797862a0fd469076fa9496549237ab413ccada2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-7027 Malicious code in @calm2026/imux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a755ff37a1fe6e18a3c050a0cf93bfadf80e790fd585c8e09a70179d07ec62f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in testis-pack (npm)

The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...

MAL-2026-11116 Malicious code in @wagni_bot/wagni (npm)

The npm package @wagnibot/wagni is a supply-chain credential stealer disguised as a the campaign's own namesake handle SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

Malicious code in @wagni_bot/solana-sdk (npm)

The npm package @wagnibot/solana-sdk is a supply-chain credential stealer disguised as a Solana SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-11111 Malicious code in @wagni_bot/hyperliquid (npm)

The npm package @wagnibot/hyperliquid is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...