MAL-2026-6360 Malicious code in tailwind-textform-fill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c56e75021e442e7d3b83168a30f734d2b3c5d636c558d7e6da2e159b11674bfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in html-to-gutenberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3edf079490239b2b4c592ce4b7094c8089596437c15a73972ebd8282484a5273 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicating credential access, install-time remote code...

MAL-2026-6358 Malicious code in fetch-page-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20a04be5fca12f18a1dc5791b41fb0e1b9feac721b8d12747f32b00a18cb67c babel.config.cjs contains a heavily obfuscated obfuscator.io-style IIFE appended after a legitimate @babel/preset-env block. It queries multiple...

MAL-2026-6361 Malicious code in vscode-test-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c62d19484eeb938a92dfdcc6cbce9dba47e390676774254b0dc318702a214418 Package occupies the unscoped npm name vscode-test-web, a likely-misreference target for the legitimate @vscode/test-web scoped package. On require,...

Malicious code in vscode-test-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c62d19484eeb938a92dfdcc6cbce9dba47e390676774254b0dc318702a214418 Package occupies the unscoped npm name vscode-test-web, a likely-misreference target for the legitimate @vscode/test-web scoped package. On require,...

MAL-2026-6328 Malicious code in @muaththir/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66954b91179d60bfbf1c18e8ed8ed9e6b12ab7b13bc6ab2a4174c3bf063c2c0a On npm install, the package's preinstall lifecycle hook runs node index.js, which collects host identifiers os.userInfo.username, process.cwd, Node...

Malicious code in @muaththir/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66954b91179d60bfbf1c18e8ed8ed9e6b12ab7b13bc6ab2a4174c3bf063c2c0a On npm install, the package's preinstall lifecycle hook runs node index.js, which collects host identifiers os.userInfo.username, process.cwd, Node...

MAL-2026-6332 Malicious code in cursorai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a04af62bb8d9774dcd39cbe7f8864477b0813e5e0b19a45ad637e94dd8ae008 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6330 Malicious code in @ravespaceio/rave-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4744e569e605ac6d749c8611417ad75dfd4d32f30fb6a75d5bcfa211d126bbd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6336 Malicious code in sync-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc297a0deaba794fdbfccc280a79c7cc895f21fc4e0122b1fba1bc4759b66c3f The package ships an obfuscated JavaScript file at shim/index.js using hex-style identifier mangling 0x391f3f, 0x3eff0a, 0x534564, etc. characteristi...

Malicious code in sync-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc297a0deaba794fdbfccc280a79c7cc895f21fc4e0122b1fba1bc4759b66c3f The package ships an obfuscated JavaScript file at shim/index.js using hex-style identifier mangling 0x391f3f, 0x3eff0a, 0x534564, etc. characteristi...

Malicious code in server-parket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a06d1b04d930608a5d15999711be4158b61d96a0f9c0c63353b3b25cd302c86 package.json declares postinstall: node test.js, but test.js is not present in the tarball — installation fails with MODULENOTFOUND and no code...

MAL-2026-6335 Malicious code in server-parket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a06d1b04d930608a5d15999711be4158b61d96a0f9c0c63353b3b25cd302c86 package.json declares postinstall: node test.js, but test.js is not present in the tarball — installation fails with MODULENOTFOUND and no code...

MAL-2026-6333 Malicious code in mjs-eslint-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e95cb81c6a1238d751c013def46001948b388083e0d91f7baa5077091ae006 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6334 Malicious code in parket-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9b185a1b54e41a8fb900a67aab43dbb78abc4fea96e9ca05d356f6864e3bdd index.js imports childprocess and invokes execSync with bash and zsh shells index.js line 1, 301, 317. Without traced execution context it is not...

Malicious code in parket-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9b185a1b54e41a8fb900a67aab43dbb78abc4fea96e9ca05d356f6864e3bdd index.js imports childprocess and invokes execSync with bash and zsh shells index.js line 1, 301, 317. Without traced execution context it is not...

MAL-2026-6315 Malicious code in ts-arithmetic-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4712d3f1a81541e2b3143f89974200358301b0a9831c3187875adc1fbe82bfbe [email protected] ships source files that copy the big.js v7.0.1 library verbatim preserving Michael Mclaughlin's copyright banner and the...

Malicious code in new-ecro-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0826d146dbc513ac14f403eaa9ba65dffbd04da52c55ff1840ad153dab96e87 The package publishes verbatim big.js v7.0.1 source including the upstream copyright header, README, repository URL pointing to MikeMcl/big.js, and t...

MAL-2026-6286 Malicious code in new-solt-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51a48524931e3ec3199917bed8d48e70c07bf91f4a0322a46926b7c1d98d8b3e index.js imports childprocess and invokes execSync with bash and zsh shells around lines 315 and 331. The shell-execution pattern alone is not...

Malicious code in new-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47f6e9bcab53d95265012a31a4dcfc1485ed6db858e788e68ac2ac1ebc33fc34 index.js imports childprocess and contains execSync calls invoking bash and zsh around lines 301 and 317. Without traced execution context, it is not...