MAL-2026-15871 Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

MAL-2026-15821 Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

MAL-2026-15824 Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

Malicious code in order-package-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb09ffe18928cf319d13dc52111750c394330d53b38b4d8814b0d2372471308e The package's postinstall hook executes index.js, which sweeps installer-owned secrets from the home directory...

MAL-2026-15816 Malicious code in order-package-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb09ffe18928cf319d13dc52111750c394330d53b38b4d8814b0d2372471308e The package's postinstall hook executes index.js, which sweeps installer-owned secrets from the home directory...

MAL-2026-15813 Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

Malicious code in test__123q1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6 The package declares a postinstall hook node dist/script.js while its declared main entry dist/index.js is an inert 105-byte stub, so the entire...

MAL-2026-15637 Malicious code in test__123q1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6 The package declares a postinstall hook node dist/script.js while its declared main entry dist/index.js is an inert 105-byte stub, so the entire...

MAL-2026-15625 Malicious code in evilpostinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...

Malicious code in evilpostinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...

Malicious code in common-array-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8dc846e743e9517d8444feb25299ce05d9c6e060a050fdaa1b3b44a8cb5cbd package.json declares scripts.postinstall = 'node index.js'. On npm install, index.js reconstructs a URL from a String.fromCharCode numeric array...

MAL-2026-15550 Malicious code in common-array-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8dc846e743e9517d8444feb25299ce05d9c6e060a050fdaa1b3b44a8cb5cbd package.json declares scripts.postinstall = 'node index.js'. On npm install, index.js reconstructs a URL from a String.fromCharCode numeric array...

Malicious code in secretkey2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook node lib/core.js that runs a Windows...

MAL-2026-15559 Malicious code in secretkey2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook node lib/core.js that runs a Windows...

MAL-2026-15563 Malicious code in vitest-chalk-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running...

Malicious code in vitest-chalk-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running...