MAL-2026-13673 Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f33793b44bee99cf40ae7b4ecfdd4d8ab388edf96753862f96b289ad3e95d2 Package contains only 2 files and no code patterns indicating credential access, network exfiltration, install-time code execution, silent relay, or...

MAL-2026-13677 Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...

MAL-2026-13679 Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...

CVE-2026-46358

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

MAL-2026-13678 Malicious code in svelte-map-visual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...

Malicious code in svelte-map-visual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...

Malicious code in svelte-cache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...

Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

MAL-2026-13491 Malicious code in rdfxvela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911 cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand signup/login/list/download/deploy, th...

MAL-2026-13492 Malicious code in rdfxvela-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef19b46ba2f8a9d7a30bedb44d2e45903d5e4e905d736b5ce5c20cbb0b77be12 The package contains 4 files and no static or traced findings indicate credential access, network exfiltration, install-time code fetch and execution...

Malicious code in rdfxvela-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef19b46ba2f8a9d7a30bedb44d2e45903d5e4e905d736b5ce5c20cbb0b77be12 The package contains 4 files and no static or traced findings indicate credential access, network exfiltration, install-time code fetch and execution...

Malicious code in rdfxvela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911 cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand signup/login/list/download/deploy, th...

MAL-2026-13493 Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

MAL-2026-13475 Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

MAL-2026-13476 Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...