Malicious code in multi-reqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...

MAL-2026-12417 Malicious code in post-css-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4 post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On...

Malicious code in elephant-array-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no...

MAL-2026-12183 Malicious code in nolimit-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bb0b18aa83b740e2cb908b4dabf469e2447548d637dbc409f1e11f88ab6b534 Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under.ad/ are post-obfuscated wi...

Malicious code in alipclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode... with a...

MAL-2026-11130 Malicious code in array-node-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0dbd4ffa55ee3a0972b3e5e3fef599244049244d9f996a9d8b809a3a3a53e1a The package's main file index.js is a heavily obfuscated obfuscator.io RC4+base64 string-array module whose top-level IIFE runs on require. It loads...

MAL-2026-11142 Malicious code in node-array-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ce58719e0587902be3a6436f329ce631317fe3a7c322d89f9c679cd6e1a744 index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and literals. On require, the...

Malicious code in neroteam-v1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19 Importing the nero package triggers nero/init.py to load nero.main, whose top-level code runs a guard routine before executing a hidden payload. guar...

MAL-2026-10868 Malicious code in neroteam-v1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19 Importing the nero package triggers nero/init.py to load nero.main, whose top-level code runs a guard routine before executing a hidden payload. guar...

MAL-2026-10720 Malicious code in @vibelet/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3dc6503f9f63413994c6d0b2e19f22ebcf17f5e7ba9f713ce26ecf69c92c6c The @vibelet/cli package ships a daemon bundle dist/index.cjs, invoked by the vibelet bin and by vibelet start/restart/reset that starts an...

Malicious code in xxdxa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a77171f4b68ff814a7a99b5e51e3d59b9d4ca41fefbd650d2a0f8412878360 The package's sole file i.js declared as main is a heavily obfuscated IIFE whose top-level exploit runs unconditionally when the module is loaded. In...

MAL-2026-10752 Malicious code in xxdxa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a77171f4b68ff814a7a99b5e51e3d59b9d4ca41fefbd650d2a0f8412878360 The package's sole file i.js declared as main is a heavily obfuscated IIFE whose top-level exploit runs unconditionally when the module is loaded. In...

MAL-2026-10738 Malicious code in mui-option (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1c3ec117eaeedbd4c3f64c2fec97d44e115d400c7e52082b7d6cc28f7c59ec The sole shipped file index.js is heavily obfuscated with a base64+RC4 string-array decoder that hides all module names, URLs, and method identifiers...

Malicious code in @funny-booth/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6693129f8b6f8b6c2d52722ca7746d6ef3dd792476297fa3583d3956548eb2b4 The package ships heavily obfuscated runtime files dist/index.js, dist/launcher.js built with javascript-obfuscator. The MCP server registered as the...

Malicious code in northstart-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns...

Malicious code in monogrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b1e012dd879b5435693fcaba708830625930df758bb32ac15058898e9244a3 Package advertises itself as a bulk-mailing / mail-server abuse toolkit homepage mntmc.rip and ships modules for bulk mail delivery func/snd/mlr/, SM...

MAL-2026-10638 Malicious code in monogrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b1e012dd879b5435693fcaba708830625930df758bb32ac15058898e9244a3 Package advertises itself as a bulk-mailing / mail-server abuse toolkit homepage mntmc.rip and ships modules for bulk mail delivery func/snd/mlr/, SM...

MAL-2026-10612 Malicious code in assertion-utils-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311d22d9694863456136cf4f8b69a291fdbb631eda56bafca1959e0c184774a1 assertion-utils-js is a typosquat of chai name, description, and keywords mirror the real package. On require, index.js spawns a detached Node child...

MAL-2026-10505 Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...

Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...