MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

Malicious code in turbo-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...

MAL-2026-16440 Malicious code in turbo-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...

MAL-2026-16434 Malicious code in catplatebarcodeparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189a06b0d55d6dab795bcb9ba3a97aa855b2556a54e85e15adc9f5bf20399976 [email protected] declares preinstall and postinstall lifecycle scripts that execute scripts/run.js on npm install. That script reads...

MAL-2026-16435 Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

MAL-2026-16437 Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

MAL-2026-16436 Malicious code in efhthrthrthregerht (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4845639223c486cf2d33751ad950cea4c7f70401877929d25c36e7d07655d820 The package's postinstall hook runs index.js, which collects the installer's OS username, current working directory, hostname, and local IPv4 address...

Malicious code in efhthrthrthregerht (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4845639223c486cf2d33751ad950cea4c7f70401877929d25c36e7d07655d820 The package's postinstall hook runs index.js, which collects the installer's OS username, current working directory, hostname, and local IPv4 address...

Malicious code in @vitemirrorte/element-plus-vite-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...

MAL-2026-16433 Malicious code in @vitemirrorte/element-plus-vite-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...

Malicious code in mxdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...

MAL-2026-16354 Malicious code in @woodpecker-web-shared/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f On npm install, the package's postinstall hook runs node index.js, which collects installer host identifiers os.hostname, os.userInfo.username,...

Malicious code in @woodpecker-web-shared/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f On npm install, the package's postinstall hook runs node index.js, which collects installer host identifiers os.hostname, os.userInfo.username,...

Malicious code in @asenfotech/unplugin-element-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...

MAL-2026-16318 Malicious code in @asenfotech/unplugin-element-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...

MAL-2026-16327 Malicious code in catwrestlingbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host...

Malicious code in catwrestlingbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host...

Malicious code in sorrawit-dev-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's...