MAL-2026-3806 Malicious code in @citi-icg-158830/elemental-chameleon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 698e88fd9d64450847d476a41187198acc173deacf9c5484791a4fdb6fbbe969 The package @citi-icg-158830/elemental-chameleon was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3804 Malicious code in bui-react-10components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd97accb94b52913accc33671fd34134afa96fd92bc09e5d0c440eef9b1a8c6 The package bui-react-10components was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3815 Malicious code in @zentrafinance/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aa8866d3eaa828e8b575d8351ed3430237e14f71bb1af0acc90c468a7e8b8cb The package @zentrafinance/types was found to contain malicious code. Source: ghsa-malware...

Malicious code in @zentrafinance/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95b69f41a2a81d2acb41f5d3282c7db06d5c90f40918246184ddec6e878c5ecb The package @zentrafinance/sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3814 Malicious code in @zentrafinance/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95b69f41a2a81d2acb41f5d3282c7db06d5c90f40918246184ddec6e878c5ecb The package @zentrafinance/sdk was found to contain malicious code. Source: ghsa-malware...

Malicious code in apexpro-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c8a3b29ed31b909fa4a13a8b310c4cee8f115748f7b708aeab52ab2b66fdbb The package apexpro-node was found to contain malicious code. Source: ghsa-malware e4cc91e23bb614febd12cef6d21d4456fb9cfa198c2aa76215d1b38dd820d9b4 A...

MAL-2026-3819 Malicious code in apexpro-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c8a3b29ed31b909fa4a13a8b310c4cee8f115748f7b708aeab52ab2b66fdbb The package apexpro-node was found to contain malicious code. Source: ghsa-malware e4cc91e23bb614febd12cef6d21d4456fb9cfa198c2aa76215d1b38dd820d9b4 A...

Malicious code in apex-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a26a7f829a26ef83ab119b6d61de6109d553f0b34432bf1efb37d5f56f4064 The package apex-connector was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3817 Malicious code in apex-trading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf744353f06f389c92cd15c56bf0ec7d29860e8af7c9618413cf65e455428eb The package apex-trading was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in deepl-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f09b2cb596d2186d9533b703e85192087a2722c8307c51428330658f1972c3a The package deepl-sync was found to contain malicious code. Source: ghsa-malware 901de6816216276cc07830e358c2cae608d89087dba87b4acf0562604011e504 Any...

Malicious code in @convera/ui-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fa0960816c1204042cecc61c5337e5db2c1407f5325cfc2ed26e43b5dc054d0 On npm install, the package's preinstall.js collects os.hostname and os.userInfo.username and sends them as query parameters /?hn=&un= via...

MAL-2026-3710 Malicious code in ethers-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8f43ab2ac9caeed4f5dd0895f4da7d3a646038768f5d0024f443bb527fd1ad95 The OpenSSF Package Analysis project identified 'ethers-logger' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in chia-network (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7439a1ad4a50c3852597bd31aaf7a3f15c53c2cb9f124b9b350e55517b5f592 The OpenSSF Package Analysis project identified 'chia-network' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2026-3663 Malicious code in chia-network (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7439a1ad4a50c3852597bd31aaf7a3f15c53c2cb9f124b9b350e55517b5f592 The OpenSSF Package Analysis project identified 'chia-network' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in truffle-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52bd5b41de871fbbc8c5895f63dfec08ba2ff6ecb9ea03fa6fdb5d9245c74616 The package.json lifecycle script invokes require'childprocess'.execSync with a curl command at install time. Running curl through childprocess durin...

MAL-2026-3716 Malicious code in truffle-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27652f23529349a6999e9121bc9714a5e9b5d11b227729c3c24147e5d2260eee package.json line 7 invokes require'childprocess' and execSync'curl...' from an npm lifecycle script. This causes the installer's machine to fetch an...

Malicious code in web3-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e42f568897d9af194eb75275059455c99b369456b0c8e0ffe13e7f32be839e6 The OpenSSF Package Analysis project identified 'web3-common' @ 1.0.0 npm as malicious. It is considered malicious because: - The package execut...

MAL-2026-3718 Malicious code in web3-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e42f568897d9af194eb75275059455c99b369456b0c8e0ffe13e7f32be839e6 The OpenSSF Package Analysis project identified 'web3-common' @ 1.0.0 npm as malicious. It is considered malicious because: - The package execut...

MAL-2026-3719 Malicious code in web3-core-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46f9612aaab12b9656a1f1b5fbd7684fdcd57833bbf76d14b2a243f679cb0977 package.json declares a lifecycle hook that invokes require'childprocess' and execSync with a curl command at install time. This pattern fetches remo...

Malicious code in aoflmkt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7d5581b164c03c1b17ecfa5e7bab0422b7168cb3a8d44108ac108467e37adbc2 The OpenSSF Package Analysis project identified 'aoflmkt' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicat...