Malicious code in @dervix/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c299d96dca6144eec3e8be8770c98430139e9b6b982762da448ef50b7bde06a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10475 Malicious code in @dervix/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c299d96dca6144eec3e8be8770c98430139e9b6b982762da448ef50b7bde06a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @gleamkit/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008464ca4d7ba15b4b8c6d3a979586c61bd527aef3a209571d28c0ba912403ae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @gleamkit/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6a306142d74b2781d66322adf2bc1b9898bfdb8e1814d2cb511c3e49b75c13 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10476 Malicious code in @gleamkit/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008464ca4d7ba15b4b8c6d3a979586c61bd527aef3a209571d28c0ba912403ae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10477 Malicious code in @gleamkit/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6a306142d74b2781d66322adf2bc1b9898bfdb8e1814d2cb511c3e49b75c13 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10471 Malicious code in loading-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94 Package name impersonates the pino logger exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js, lib/redaction.js,...

Malicious code in loading-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94 Package name impersonates the pino logger exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js, lib/redaction.js,...

Malicious code in @uw010010/vite-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280687ad50e03b43bf7f26df6afb1a8fb794eb486c126b2368f37c6b76625318 The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author 'Evan You', description...

Malicious code in @sheltr_/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ecc4dcd6d76f100601f8b37a6b9c3aab899770ab361f2714f9193a2f8d0db78 When the package's bin entry is run, it spawns an interactive PTY shell using $SHELL with the user's full process environment and HOME as the working...

MAL-2026-10455 Malicious code in @origindev/ethaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21a07b9029fb9a0c16ec0d934edab2123c43d1999489d510c3bbabc5a0f1d5e7 @origindev/[email protected] ships a single heavily obfuscated index.js wrapped in an RC4 string-array decoder with IIFE rotation and a self-defending...

MAL-2026-10468 Malicious code in nodemon-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8b1d5b3dd215c6c8d726b73ad11fbb29e7285da9a7e88854552931f750d437 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in nodemon-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8b1d5b3dd215c6c8d726b73ad11fbb29e7285da9a7e88854552931f750d437 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10462 Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

MAL-2026-10458 Malicious code in compliancepolicyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9f18c11413e208ef48e083af8a065b36134c2b37b5fd1474a5701a986a659d8 [email protected] registers index.js as both scripts.install and main. On npm install and on require, index.js loads lib/core.js, which rea...

MAL-2026-10459 Malicious code in connectedmerchantsserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 834b886e34ea551223e9eeb30561267c93226eac960729a9a0ff6a06277c74cf The package's scripts.install lifecycle hook runs node index.js, which loads lib/core.js. That module collects the installer's OS username, hostname,...

Malicious code in node-path-addon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dbc52a88818bccd5602eb556ea4bf089dac66c44a2bb1ecbd6fddd6723e9d1d node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry path.js delegates by executing...

CVE-2026-39245

A flaw was found in the decompress component. An improper path containment check allows a local attacker to perform directory traversal. This vulnerability, when combined with unvalidated symlink creation, enables an attacker to write arbitrary files to directories outside the intended extraction...

MAL-2026-10454 Malicious code in nodemon-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adb05cacc2c6d1059d9ee1d433398f8e39314ce83aed1429582e5fbb47e8f13a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...