MAL-2026-11484 Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

MAL-2026-11488 Malicious code in test-dev-boot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd45eccde1d78006f2a808730aa4723756d255697ac1479d52aa7e89f792e51 On require/import and when invoked as a bin, the package's main entrypoint detects Windows and installs an...

Malicious code in test-dev-boot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd45eccde1d78006f2a808730aa4723756d255697ac1479d52aa7e89f792e51 On require/import and when invoked as a bin, the package's main entrypoint detects Windows and installs an...

Malicious code in test-dev-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b3df759cd11b9c662bed5840b0671d4e9c54a76a606d284ca39390ecf51f8d [email protected] connects out to a hardcoded socket server host/port sourced from the test-dev-config module and enters a receive-loop that...

Malicious code in test-dev-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42ca0e645623ac78190f4921a1d577eeaaeaaca953f6310565db2b981d90b21 The package contains three files and produced no a static rule matches and no traced code behaviors of concern. The name and version pattern suggest ...

Malicious code in test-dev-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6205523817ec8f05eccf82a334fa70429c8c326b73c27e031fe991b9abdbdb The package exposes handlers that receive messages over a network connection and dispatch them to shell execution, arbitrary-path file exfiltration,...

MAL-2026-11493 Malicious code in test-dev-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e03286d5422408fe1567e37542070ac8d0610b319d57e941e3dcb2c28004bfc test-dev-store is a library module of an infostealer toolkit. utils.js exports path builders that specifically target Chrome/Chromium profile...

Malicious code in test-dev-watch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...

MAL-2026-11495 Malicious code in test-dev-watch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...

Malicious code in test-dev-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4f4885b543da795140d0ac9c44423c6ecadf74c744c1f322f9d1a5263fe4f2 No static or traced behavioral signals of supply-chain attack were observed in this package. There is no evidence of install-time or import-time code...

MAL-2026-11494 Malicious code in test-dev-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b79a278016b87011ec1e810ce455d87ab6346a1045cc007e0155b204c8cc2532 test-dev-sync is a browser data stealer coupled to a remote-command backdoor. grabberuser.js enumerates Chrome/Chromium/Opera/Vivaldi profiles under...

MAL-2026-11490 Malicious code in test-dev-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42ca0e645623ac78190f4921a1d577eeaaeaaca953f6310565db2b981d90b21 The package contains three files and produced no a static rule matches and no traced code behaviors of concern. The name and version pattern suggest ...

MAL-2026-11439 Malicious code in @global-theme/context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b48962d911b70fd09f4c001b44b879452dda607f877256d2f85d64538912ab7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in metrics-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...

Malicious code in refbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...

MAL-2026-11477 Malicious code in refbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...

MAL-2026-11455 Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

MAL-2026-11459 Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...