Malicious code in ratelimitsucks5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a8e8337f9df3011cf32fbc4bb478d960681df93aaaddfdec39034a123a9b5b The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10388 Malicious code in timmytuffknuckles3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca256e52e28fe9f7cfdd4c0b42e699f1b29c5e141df2ad73d7737f522fc7c85 The package ships twelve heavily obfuscated JavaScript files under assets/ e.g. assets/3oruu3por5.js, assets/6y4sp7rdhb.js, assets/wlaswqv83p.js, eac...

Malicious code in sixseven6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fce7a5f40c9f40116627ed8a771d60c34786bc52648e39e0741fe392ed0120b The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

Malicious code in sixseven1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96e63dd12f3157bb49fe3951bfb356c83b4b7349eed5947af87b09c40c868382 The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

MAL-2026-10331 Malicious code in kirkland (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fbd3da78615dc607bb287e809874ccce081e816a5eeb1120421118da70bcba5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10299 Malicious code in crazynut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99acc5fd6f39abd90d81467df8fe55d92230edd286a12d9f628ad6f9c1c34a9a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10287 Malicious code in backup3-ff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a32646e3ad3e35186f8344c19ccdecfd69c26e8047fc44b77c0516b644fd094 The npm package [email protected] ships multiple heavily obfuscated JavaScript bundles under assets/ AccountPage, DarkVeil, GamesPage, PlusBlockedNote...

MAL-2026-10387 Malicious code in thebigyahu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eb60a0e719514988070d96c3cedea8d918edccef68203afe3cda86635c607de The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in backup3-ff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a32646e3ad3e35186f8344c19ccdecfd69c26e8047fc44b77c0516b644fd094 The npm package [email protected] ships multiple heavily obfuscated JavaScript bundles under assets/ AccountPage, DarkVeil, GamesPage, PlusBlockedNote...

Malicious code in omglucidesotuff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d144d98f0e90909ee371acfeeec0ad2ffe44450335ddf7f7a58f71a53dc7b107 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in midnightrush (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94313bf7eca9c82a6e6e6d8f3a7230fcdf936da5ff66069639e1957b4a8d2fe3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in backup2-asd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6fe96add7d70ce5933988f1c78b934187e279d88618bd3f211de3d719177168 The tarball published as [email protected] is a Vite-built browser application branded 'Lucide' rather than a Node library. package.json declares mai...

Malicious code in omgyesyesyes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eeb53892156b3a1354703f4f8beb2591548726886a017ccc7129407eb128ed9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ilovefemboys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdc298baaa7b820adecfa54fb1190c2feea422da1a03ec48b14d55b996d6cc6e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in backup5-updated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fbc0dc5fea4212458853e895b9b9df474401727a4768f47e3016a8c871fd5c7 The package tarball contains multiple heavily obfuscated JavaScript bundles under assets/ AccountPage, DarkVeil, GamesPage, PlusBlockedNote,...

MAL-2026-10296 Malicious code in bomboclatwallahi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a7d4f08c0c79c42f9938a1c11d3d6828907fb309e582faf38065bbd04f5149 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bomboclatwallahi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a7d4f08c0c79c42f9938a1c11d3d6828907fb309e582faf38065bbd04f5149 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in changiairportpromax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13ab194f6c4e1d4197856c229f74ebf46e7eb90ff703ff4dc3172379aea96923 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10301 Malicious code in fflc-updated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0da486d000821631873ccd6fbb8eac17ee6dc94e8802946ef9d4cd288048e95 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10396 Malicious code in whatsadmaidk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 604f59cbac58a8e35ba82016c72efe0c02226eec9273e96ee9215dd72cbe0392 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...