MAL-2026-13648 Malicious code in sme-rko-finance-front-operations-special-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a7bfbc55631ce8b054b20444bf1e335244c998fcf00d1709f951b1afa4cb242 On require of the package, index.js loads support.js which downloads a platform-specific binary from string-concatenated cloudflare workers.dev...

MAL-2026-13220 Malicious code in bigops-jsonpath-mapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 784552abf30d07bd647e0c3844dc45ea0205cf20c166ca1e38ef924c5fd999b7 On require of bigops-jsonpath-mapper, index.js loads bridge.js which assembles hostnames from string-array joins to hide the destinations...

Malicious code in dolyame-ui-checkable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c index.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of...

MAL-2026-13163 Malicious code in dolyame-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31 On every require of dolyame-ui-layout, index.js loads platform.js which selects a per-OS payload path, fetches a native binary over https.get from...

Malicious code in dolyame-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31 On every require of dolyame-ui-layout, index.js loads platform.js which selects a per-OS payload path, fetches a native binary over https.get from...

Malicious code in dolyame-ui-textarea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24932ddb1e2cd6672b95aae062c330f9aec9d68ee293488d54d195fbbf0acc52 The package's main entry unconditionally requires./loader.js on load. loader.js assembles mirror hostnames from split string arrays to build a set of...

Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in bnpl-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins e.g...

MAL-2026-12553 Malicious code in checkout-desktop-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b The package's main entry unconditionally requires./loader on load. loader.js reconstructs C2 hostnames from string fragments oob-worker.cf.workers.de...

Malicious code in checkout-format-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224 [email protected] executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js...

MAL-2026-12479 Malicious code in time-linters-webapp-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b89eb401bae118699fcd79b686c0d6ace5e579df1ea42a87d6ad18de405614c The package's top-level index.js unconditionally requires./runtime on load. runtime.js assembles a rotating list of Cloudflare Workers hostnames...

Malicious code in tailwind-opentype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5a3e0b9f27817cc8e965ed397d0ec2a01b2e13f26051ee6c0e884fa5008beb dist/index.js re-exports a benign Tailwind plugin and appends an evalatob... payload that runs when the module is required e.g. from a project's...

MAL-2026-12100 Malicious code in @wethenorth12/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2 @wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home...

MAL-2026-11130 Malicious code in array-node-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0dbd4ffa55ee3a0972b3e5e3fef599244049244d9f996a9d8b809a3a3a53e1a The package's main file index.js is a heavily obfuscated obfuscator.io RC4+base64 string-array module whose top-level IIFE runs on require. It loads...

Malicious code in n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9256e5f20f66f3eb9875dcc475299249173730d784230eb157c327171d114e21 The package advertises itself as an n8n community node 'Utility nodes for n8n', but the declared community node file MyNode.js is an empty stub and t...

Malicious code in n8n-nodes-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991093c97f0d954740c4b72a2e7725a501df211c94634979ebadc52652f2ebe8 The package impersonates the n8n task-runner subsystem but its shipped n8n node MyNode.js is a no-op stub whose execute returns . The real payload...

MAL-2026-10614 Malicious code in postcss-selector-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fec62079856815ded46ba283769d3d3e0d20e08b6196b8698e08e2df6677ee Package is published as postcss-selector-minify a word-order permutation of cssnano's widely used postcss-minify-selectors and registers itself to...

MAL-2026-10530 Malicious code in cbr-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7 On module load, the package's main entrypoint shells out via childprocess.exec to run cat /etc/passwd and prints the contents to stdout. This fires...

PYSEC-2026-3141 Core dump when loading TFLite models with quantization in TensorFlow

Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling...

Malicious code in ts-eslint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5bbed232e0268a791ce846260ce170342eec359bf1a7e84b9514767d77803a1 The package's index.js defines run/fromstr that recursively walk process.cwd and match files named.env, env, id.json, config.json, config.toml,...