MAL-2026-18498 Malicious code in @goparrot-dashboard/franchise-directory (npm)

@goparrot-dashboard/franchise-directory is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/loyalty (npm)

@goparrot-dashboard/loyalty is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0...

Malicious code in @goparrot-dashboard/franchise-menu-settings (npm)

@goparrot-dashboard/franchise-menu-settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same...

MAL-2026-18451 Malicious code in contracts-upgradeable (npm)

contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

MAL-2026-18459 Malicious code in wallet-adapter-base (npm)

wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in wallet-adapter-base (npm)

wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

MAL-2026-18457 Malicious code in bigbob22-test (npm)

[email protected] has no functional code and an empty README. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in bigbob22-test (npm)

[email protected] has no functional code and an empty README. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

MAL-2026-18492 Malicious code in @goparrot-dashboard/app (npm)

@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 ...

Malicious code in @goparrot-dashboard/app (npm)

@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 ...

MAL-2026-18456 Malicious code in axelarjs-sdk (npm)

[email protected] takes the unscoped name of @axelar-network/axelarjs-sdk and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in axelarjs-sdk (npm)

[email protected] takes the unscoped name of @axelar-network/axelarjs-sdk and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in sol-wallet-adapter (npm)

sol-wallet-adapter takes the unscoped name of @project-serum/sol-wallet-adapter and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

MAL-2026-18452 Malicious code in sol-wallet-adapter (npm)

sol-wallet-adapter takes the unscoped name of @project-serum/sol-wallet-adapter and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in cutekitten-test (npm)

[email protected] describes itself as a security test package for a school project and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

MAL-2026-18458 Malicious code in cutekitten-test (npm)

[email protected] describes itself as a security test package for a school project and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in calculator-preinstall-hook-demo (npm)

[email protected] presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook...

MAL-2026-18454 Malicious code in calculator-preinstall-hook-demo (npm)

[email protected] presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook...

Malicious code in calculator-preinstall-chain-demo (npm)

[email protected] has no install script of its own but depends on exactly [email protected], so npm install runs that package's preinstall script node preinstall.js. The script POSTs the machine's hostname and the OS username to the Discord webhook...

MAL-2026-18453 Malicious code in calculator-preinstall-chain-demo (npm)

[email protected] has no install script of its own but depends on exactly [email protected], so npm install runs that package's preinstall script node preinstall.js. The script POSTs the machine's hostname and the OS username to the Discord webhook...