PT-2026-69996

Name of the Vulnerable Software and Affected Versions react18-use affected versions not specified Description react18-use, a React 19 use hook shim, contained malicious commits in its default branch between 2026-05-19 01:07:01 and 2026-05-19 15:20:43. The issue involves the addition of...

MAL-2026-13630 Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...

Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...

MAL-2026-13450 Malicious code in move-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00077e83bd841dae96e61d432da796cf21839a32e5caf03e7256b2573225335 [email protected] declares a postinstall hook package.json line 7: "postinstall": "node install.js" that runs install.js on npm install. install.j...

MAL-2026-13366 Malicious code in @workoscalif/sudoku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217 package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a 34 kB static...

Malicious code in dlab_workshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452b525d6d3fc409e081d5f8a6f052c7b3b9899d1f088a24d93e4be4de65c9cf The package's index.js reads installer-owned secret files from the home directory /.ssh/idrsa, /.ssh/ided25519, /.ssh/config, /.aws/credentials,...

Malicious code in @cy4dev/cydemo-bg-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0 @cy4dev/[email protected] ships a postinstall lifecycle script src/postinstall.js that runs at npm install time and invokes node:childprocess.exe...

MAL-2026-12504 Malicious code in @cy4dev/cydemo-bg-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0 @cy4dev/[email protected] ships a postinstall lifecycle script src/postinstall.js that runs at npm install time and invokes node:childprocess.exe...

Malicious code in voicemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...

Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

MAL-2026-12358 Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

Malicious code in @kite-js-tools/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9 package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall hook performs an HTTPS GET ...

Malicious code in rollup-plugins-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2c7fe6586c3734730d6f8cd5ffe893c3f7cc5ff82710d1f4df22b8e76987e8 The npm package [email protected] declares a postinstall script node dist/module.js that, on npm install, performs an HTTPS GET to...

Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

Malicious code in @shiftmarkets/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82 The package declares a postinstall script node dist/recon.js that runs automatically on npm install. The script collects installer-side reconnaissanc...

Malicious code in luluking3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays...

Malicious code in electrode-ota-ui-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498 Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private...

Malicious code in luluking2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 495a71c4dcddec545026181c7faeef59cf4c79b4816a148fb88c59c5465e8c97 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL from a char-code array String.fromCharCode.apply on a numeric...

Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

Malicious code in @cryptosrvc/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host...