MAL-2026-16380 Malicious code in chai-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 566e54855d730e8555b93da4f8ea81faba72645079a7adcc3a05ea8bf8ad8ee6 The package presents itself as a Chai logging plugin but its main entry index.js requires ./lib/query.js, a 4 MB obfuscator.io-encoded module...

MAL-2026-16349 Malicious code in hardhat-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95 Package published as hardhat-devkit presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README,...

Malicious code in chai-as-crack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21 Package's main entry index.js unconditionally requires./lib/config at top level, causing the file to execute on any require'chai-as-crack'...

MAL-2026-16196 Malicious code in chai-as-crack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21 Package's main entry index.js unconditionally requires./lib/config at top level, causing the file to execute on any require'chai-as-crack'...

Malicious code in openaii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d982f068d7525c41b811b82cede3710e7b614363abae75c356e6c280412baf The package name 'openaii' is a one-character edit of 'openai' and its PyPI summary copies the official openai project description verbatim 'The...

MAL-2026-16131 Malicious code in aitextutils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-16047 Malicious code in @usemosaik/template-react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...

MAL-2026-15995 Malicious code in multicore-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d643b52dafcb56aba0bd945697117be2a15447bcb4b183aabff3fa72824b75fb [email protected] is published under a spoofed author identity Blake Embrey, maintainer of array-flatten and advertises itself as an array utility,...

MAL-2026-15969 Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

Malicious code in node-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e7475543fb41397ba49574f9b16340e671160b13bb100bb0db6c4acc2fb154e The package impersonates the legitimate blakeembrey/node-helper library matching author metadata, README, MIT license, and top-of-file helper functio...

Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

MAL-2026-15925 Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

MAL-2026-15565 Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

Malicious code in tset_racie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871 [email protected] ships a single 45KB obfuscator.io-style payload as its main entry index.js. The file consists of a 551-entry RC4-encrypted string...

Malicious code in zenntechinc-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ab82f90e45185d5e25435ce8fc92501dbf7b7384ec6eea6e6b7416ac9426cfb The npm package ships an obfuscated payload appended to templates/backend/.eslintrc.js, after a legitimate-looking ESLint config. The payload uses...

MAL-2026-14539 Malicious code in zenntechinc-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ab82f90e45185d5e25435ce8fc92501dbf7b7384ec6eea6e6b7416ac9426cfb The npm package ships an obfuscated payload appended to templates/backend/.eslintrc.js, after a legitimate-looking ESLint config. The payload uses...

Malicious code in chai-as-mno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381 The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project pino, while the package.json...

MAL-2026-14427 Malicious code in chai-as-mno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381 The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project pino, while the package.json...

Malicious code in babel-polyfill-plugin-corejs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13878d994b01607c379e26646449b7cca95099f9b2eb5be2e1f8e19aeea32eb3 The package advertises itself as a Babel core-js 2 polyfill plugin, but the shipped lib/index.js contains unrelated web3-core-subscriptions boilerpla...

MAL-2026-14426 Malicious code in babel-polyfill-plugin-corejs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13878d994b01607c379e26646449b7cca95099f9b2eb5be2e1f8e19aeea32eb3 The package advertises itself as a Babel core-js 2 polyfill plugin, but the shipped lib/index.js contains unrelated web3-core-subscriptions boilerpla...