Malicious code in tinkoff-fb-app-frame-page-height-dippy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db9a5313417dcbe6f8514736de7dd82892ad5cdccc261e0064d8f76f8d9613e On require, index.js loads platform.js, which reconstructs C2 hostnames via runtime string concatenation joining fragments such as...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcb1561dd1153104da17218a74c318e8d497b4df1429bbbda8cda0144bd06ce On require of the package's main entry, index.js transitively loads platform.js, which selects a platform-specific payload URL, fetches opaque...

Malicious code in streak-math-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...

MAL-2026-11140 Malicious code in korvica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODEENV!== 'production', checks for a WSL host mount at...

Malicious code in parallely (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...

MAL-2026-11143 Malicious code in parallely (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...

Malicious code in async-mutex-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7df420be80a00abb5efead6e83b37885cc37a347641386c0633719197dcb3dc5 Package published as 'async-mutex-v2' advertises itself as a Promise-based mutex but ships no mutex implementation. The main entry index.js exports...

Malicious code in @wrenfield/abitype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1b16f2fdde2184bdcfb6f2c91f18c328dee9aa1bb111f86d3130f47c42c9e5 Package @wrenfield/abitype impersonates the well-known wevm/abitype library: it copies the upstream README verbatim links to abitype.dev, wevm.eth,...

MAL-2026-10523 Malicious code in @tabrex/bs58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f8a6402182b6dec89b04f15d70fcdd2b78d678947d49c62a3f09b11a70bf306 @tabrex/bs58 ships the verbatim README, API surface, and repository URL of the legitimate cryptocoinjs/bs58 package package.json declares repository...

Malicious code in gifuct (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965f65127a6b6d2a6865e91efe6a878ae1e076b9ef4de23152aef4ee6080038b Package name typosquats the legitimate gifuct-js GIF parser and re-exports it as cover. On module load, code reconstructs the host...

Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

MAL-2026-10091 Malicious code in qlinforge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713a696ce725031aab16903d7a29c80611a4c4368c7e35bacf29069a3581c602 setup.py registers a custom install command that, on Linux, downloads an opaque binary from http://115.190.124.243:9090/payloadlinuxamd64 to...

Malicious code in multer-orm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb45c09aa7a237b2b9ff18ccf6426b76a4f46e5ea665c7747f35a345940e161 multer-orm is a typosquat of the widely used multer middleware. Its README is copied from multer, but the package adds a load-time dropper in...

MAL-2026-10064 Malicious code in multer-orm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb45c09aa7a237b2b9ff18ccf6426b76a4f46e5ea665c7747f35a345940e161 multer-orm is a typosquat of the widely used multer middleware. Its README is copied from multer, but the package adds a load-time dropper in...

MAL-2026-6510 Malicious code in @merceas/cross-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6307129b7d9edcbd76ffc93c9d8a6ae146332951d5ce90e659afe1eec01127 Package is published under the @merceas scope as cross-fetch and reuses the upstream cross-fetch README, homepage github.com/lquixada/cross-fetch, an...

Malicious code in macos-ci-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f342b002e02396d7f82ee89e77140204c35b673411afd05bc1b3ca91c895a06 On first require of the package, index.js decodes a base64-encoded URL https://api.ingress-hub.com/cdn/assets/update.pkg and downloads the response t...

MAL-2026-6357 Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

MAL-2026-6299 Malicious code in analysis-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...