MAL-2026-4834 Malicious code in @polka-ui/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 662c2a1b8ad5d264ec01b078f95c130c96398305ba009a2c2de33cc9d7db7486 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dds-js-idl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c864bc6e21a3795faba4de876942dfffa4baed76c926d96d52c83c32d1f49f69 On npm install, postinstall.js runs whoami via execSync and collects os.hostname, os.platform, cwd, and CI/GitHub env vars, then exfiltrates them ove...

MAL-2026-3509 Malicious code in pp-react-v5 (npm)

pp-react-v5 is a dependency confusion package published at the inflated version 10.0.0 to win npm resolution over any internally-hosted package of the same name. The package contains only a package.json with no functional source code. On installation the preinstall script executes a wget command...

Malicious code in coral-dev-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 938459f8d0b02585c73f8dedee34a7e499784f290f4c9cabf61706eeda5bbfe1 The package coral-dev-proxy was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ally-badges (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 628f679ca3d11168a5d0e0930680b72c113158a013369f538a273ce91cb5e5a6 The package ally-badges was found to contain malicious code. Source: ghsa-malware 9c052706f47011272c0f6a24723dc146f15603ac21d81708fa2b91678889df60 An...

MAL-2026-3103 Malicious code in amzn_codewhisperer_streaming_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7fc27be867bc1ae651b345d2f825d0ac8d796615c022747306e87bd3ff0d1fc8 The OpenSSF Package Analysis project identified 'amzn-codewhisperer-streaming-client' @ 99.0.1 crates.io as malicious. It is considered maliciou...

Malicious code in @google-pay-trust/finish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd69ccad4854f078fe0d815a4f14a1b8ef69fd62704fbf4be49710a2c3926b2 The package @google-pay-trust/finish was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3083 Malicious code in elementary-data (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 96dc65f67f54411d3de6b23a33a8f73665e2703d7261b7f1720cdc089c528eea Versions 0.23.3 were compromised. A threat actor exploited a vulnerability in the CI workflows to inject code and establish, likely, a reverse shell in the CI...

MAL-2026-2980 Malicious code in @bmg-web/bmg-ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d0060c1d5029ed1bcb3ed00c20e6a283a930b13d6e93072cebb3e97e45b78d The package @bmg-web/bmg-ajax was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2953 Malicious code in bmg-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26777925b4f8e199b125a969ad8c6f4e0ff672b87613b22ce2b67fe461ba218e The package bmg-web was found to contain malicious code. Source: ossf-package-analysis 27618387221affefb03509d50b0545c22b6d18574bc71aa6f218350ca5f152...

Malicious code in megabank-worklist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f0a379223d486978f097d6f97b1d3a1fd307bb725be56c7baa2bc8ff72d297 The package megabank-worklist was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2858 Malicious code in @source-row/source-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef1f8f064936d70cf38ce81e5a991bd0514ea059213b17683bf77edfb8cba45b The package @source-row/source-container was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in pt-sc-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 925a5c001d049ecefbe72bc5ba4090904c882bf13b6f97493387fe3ed04a661f The package pt-sc-logger was found to contain malicious code. Source: ghsa-malware deaf63bd8a081fcc49f46fdb9b4300abef500b33eba7034bbd8de142a60db3cd A...

MAL-2026-2566 Malicious code in wm-plugin-visions-recorder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9fc7d1b94e873a6acaa539c03b3deb578141de07e79343acb659b17d4815077 The package wm-plugin-visions-recorder was found to contain malicious code. Source: ghsa-malware...

Malicious code in xpna-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 678a96ef06b05d2ab867c1eea4dbed1cfc69f99cb4904e02c48736df0da7695e The package xpna-context was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in shakti-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f2263a09a764a00c111f0baad35ef067d15ac1baaf92efd30cf27d86a4adc66 The package shakti-strings was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in get-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d55d952f3fb507a89362a1535e7cf7d781b6f26e82c7130ca008af612bfddf4 The package get-fonts was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in react-markdown-canvas (npm)

Malicious package due to data exfiltration via Discord webhook on install. Collects IP, hostname, and date without consent. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4123db6526d8c37f99fa33e2524edc97922efef6b1605dc0a8acdbf41e76cc77 The package...

MAL-2026-994 Malicious code in vl-ui-code-preview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abf0716d5a814e3cd0ca1da245819d81f5238adb1911513d88b36825c7a99be The package vl-ui-code-preview was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-943 Malicious code in ethereums-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bddbe5ea052b93fa04966b01c8302455e06311fd6015aaf9c76c07ba8c8f21c4 The package ethereums-lint was found to contain malicious code. Source: ghsa-malware 7671a5fea1c5f2b0118bd9981213bde2b546a4191a57acd041aed6d8560c0de6...