MAL-2026-13990 Malicious code in wct-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node.js version,...

Malicious code in @secauditb20y/sec-test-r3b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c package.json declares a postinstall script that runs node -e to invoke fs.writeFileSync, creating /tmp/PWNR3REAL/FIRED on the installer's machine whe...

MAL-2026-13989 Malicious code in @secauditb20y/sec-test-r3b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c package.json declares a postinstall script that runs node -e to invoke fs.writeFileSync, creating /tmp/PWNR3REAL/FIRED on the installer's machine whe...

MAL-2026-13972 Malicious code in @jacksher/install-exec-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423 package.json declares postinstall: node beacon.js. On every npm install, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to...

Malicious code in @jacksher/install-exec-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423 package.json declares postinstall: node beacon.js. On every npm install, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to...

Malicious code in notafollower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768 [email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. T...

MAL-2026-13986 Malicious code in notafollower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768 [email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. T...

Malicious code in datefmt-util-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node...

MAL-2026-13978 Malicious code in datefmt-util-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node...

Malicious code in xrblocks-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76393473878ee61f371bcb238c278a7ae68f2a802d5a8b017d72812ab61c3c09 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers hostname, platform, arch, node...

MAL-2026-13988 Malicious code in xrblocks-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76393473878ee61f371bcb238c278a7ae68f2a802d5a8b017d72812ab61c3c09 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers hostname, platform, arch, node...

Malicious code in tizen-webdriver-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf90f542c0f81ff50f903a216f44a5870bc0ac5ede472fa2c41af447994b58e4 On npm install, the package's postinstall lifecycle script collects host identifiers os.hostname, process.platform, process.arch, Node.js version,...

MAL-2026-13966 Malicious code in tizen-webdriver-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf90f542c0f81ff50f903a216f44a5870bc0ac5ede472fa2c41af447994b58e4 On npm install, the package's postinstall lifecycle script collects host identifiers os.hostname, process.platform, process.arch, Node.js version,...

MAL-2026-13965 Malicious code in nc-verify-127942 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ea69188e179cd73aa9f200d63e8faceb5d3aae622a8fe2d86bf7ae761b5f1e0 nc-verify-127942 declares a postinstall lifecycle hook "postinstall": "node install-cb.js" that runs automatically on npm install. The install-cb.js...

Malicious code in nc-verify-127942 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ea69188e179cd73aa9f200d63e8faceb5d3aae622a8fe2d86bf7ae761b5f1e0 nc-verify-127942 declares a postinstall lifecycle hook "postinstall": "node install-cb.js" that runs automatically on npm install. The install-cb.js...

MAL-2026-13941 Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Malicious code in functions-framework-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node...

MAL-2026-13951 Malicious code in functions-framework-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node...

Malicious code in fmt-util-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e8613ffc5393a31685344c247925a5ef104f7daf3f0d2f45a51918adba7d344 [email protected] advertises itself as a trivial string-formatting utility index.js exports two-line pad/trim helpers, but its package.json declare...

MAL-2026-13950 Malicious code in fmt-util-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e8613ffc5393a31685344c247925a5ef104f7daf3f0d2f45a51918adba7d344 [email protected] advertises itself as a trivial string-formatting utility index.js exports two-line pad/trim helpers, but its package.json declare...