MAL-2026-1588 Malicious code in @bingads-webui-help/apex.core.v3.min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87351101634ee5726eaa0ee76ecaec8529226c993a610ea5a2d1b7521778bd5a The package @bingads-webui-help/apex.core.v3.min was found to contain malicious code...

Malicious code in @at-point/valiant-widgets-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87532b33037ce0d72b75f2ca654c5b66bf97048b3d1226ca6bdb396af6670c4a The package @at-point/valiant-widgets-v2 was found to contain malicious code...

MAL-2026-1585 Malicious code in @anchor-ds/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaac3fbc20e4d10a4fcf379fa4637f05e1dccd9fb6123bdd9b0e26ce5e21854 The package @anchor-ds/core was found to contain malicious code...

Malicious code in @anchor-ds/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaac3fbc20e4d10a4fcf379fa4637f05e1dccd9fb6123bdd9b0e26ce5e21854 The package @anchor-ds/core was found to contain malicious code...

MAL-2026-1542 Malicious code in bugbounty-test-123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c22630300fe50578818f50f4a068d400f9e434dc0341fff5a6cd0ca63e82d5e1 The package bugbounty-test-123 was found to contain malicious code. Source: ossf-package-analysis...

Malicious Package

Overview winderlingz is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in whatfix-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 003442c235ba313d832b958d8170e59f28d9af34abdd1f33a832c6c2cd263696 The package whatfix-icons was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in navi-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d7c20b1a93d0713a7cd64e5937906dc8db43fe90795827cedac30fc64031c68 The package navi-design-system was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-1494 Malicious code in navi-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d7c20b1a93d0713a7cd64e5937906dc8db43fe90795827cedac30fc64031c68 The package navi-design-system was found to contain malicious code. Source: ossf-package-analysis...

Malicious Package

Overview pino-logger-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1490 Malicious code in ember-power-calendar-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55191162c66f85fd90f4c2bb6354b569a7ab7cdc6a380289defcc8be784ed434 The package ember-power-calendar-utils was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview asset-delivery is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in graphlib-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc5e5e2ae1439a28be92e99758c3253bf2bd09a568712a5d0725553b4836eaf The package graphlib-js was found to contain malicious code. Source: ghsa-malware 375768659fc55b18acf652226fabd9052c10c4f88d36f150317532bc8661df13 An...

MAL-2026-1481 Malicious code in revolut-merchant-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be3c58d0da88dbc307fda899df07f7e6badfcba4ccb5f98ce68e1daef3caa8c7 The package revolut-merchant-widget was found to contain malicious code. Source: ghsa-malware...

Malicious code in revolut-merchant-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be3c58d0da88dbc307fda899df07f7e6badfcba4ccb5f98ce68e1daef3caa8c7 The package revolut-merchant-widget was found to contain malicious code. Source: ghsa-malware...

Malicious code in aesdecryptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ac66c3676fdc79338dd38b32cacdd68d6f86e097c163eb1e8e4bd556de82c69 The package aesdecryptor was found to contain malicious code. Source: ghsa-malware 67de86e4e1b93130bb4f76480f236f202b1f257067eaf1ca02d3c565c2fc8edb A...

Malicious code in jalalstealer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18913d1d0805eb9183a23aedfba3cbef762c642f82c079dd24711102fd20951e The package jalalstealer was found to contain malicious code. Source: ghsa-malware d760ddb75dc632737c4e778e0ac4db4522bd8584240834cbefe9bffa1948999c A...

MAL-2026-1474 Malicious code in alinet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b467881e1d3ebf0402af06e37a9431db8eead8b2aed583e62a953e32bd5b4e The package alinet was found to contain malicious code. Source: ghsa-malware 4baa8516c4794b690aab6709c29a53d2aa06731b95e9df071cc4b062d421e026 Any...

MAL-2026-1473 Malicious code in aesdecryptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ac66c3676fdc79338dd38b32cacdd68d6f86e097c163eb1e8e4bd556de82c69 The package aesdecryptor was found to contain malicious code. Source: ghsa-malware 67de86e4e1b93130bb4f76480f236f202b1f257067eaf1ca02d3c565c2fc8edb A...

EUVD-2026-12107

In Bun before 1.3.5, the default trusted dependencies list aka trust allow list can be spoofed by a non-npm package in the case of a matching name for file, link, git, or github...