MAL-2026-14422 Malicious code in @medisend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...

Malicious code in @medisend/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18f32429d1bfdc9438f2f03f531e5c2fef53e0e69104e3124499cf6f42ce52a1 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/ with the installer's hostname appended as a query...

MAL-2026-14432 Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

Malicious code in consumerweb-serverutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...

MAL-2026-14428 Malicious code in consumerweb-serverutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...

MAL-2026-14436 Malicious code in poly-price-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which...

Malicious code in auth-otp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script...

MAL-2026-14438 Malicious code in remove-bg-serverless-azure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e package.json declares preinstall: node index.js, so npm install automatically runs index.js. index.js reads os.hostname, os.userInfo, the user home...

Malicious code in remove-bg-serverless-azure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e package.json declares preinstall: node index.js, so npm install automatically runs index.js. index.js reads os.hostname, os.userInfo, the user home...

Malicious code in paypal-business-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 556bfd93652f806523495944dc8a441624c9a2dae4f76eadeefa9650f57091a1 The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, and walks up to 15 parent...

MAL-2026-14435 Malicious code in paypal-business-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 556bfd93652f806523495944dc8a441624c9a2dae4f76eadeefa9650f57091a1 The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, and walks up to 15 parent...

MAL-2026-14433 Malicious code in manticore-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184c02a26613b94b15f0abe1ed108c7a2a7a061f795213dba4772876e6e0a015 The package's preinstall lifecycle script fires automatically on npm install and collects the installer's OS username, hostname, current working...

Malicious code in manticore-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184c02a26613b94b15f0abe1ed108c7a2a7a061f795213dba4772876e6e0a015 The package's preinstall lifecycle script fires automatically on npm install and collects the installer's OS username, hostname, current working...

Malicious code in ppb-manticore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward...

MAL-2026-14437 Malicious code in ppb-manticore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward...

MAL-2026-14440 Malicious code in web-advertising (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7c0c1f060691740d5149c61d74f3ddd8f6e10107c7621d700ae0819a1e2237 [email protected] declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install. The script collects...

Malicious code in web-advertising (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7c0c1f060691740d5149c61d74f3ddd8f6e10107c7621d700ae0819a1e2237 [email protected] declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install. The script collects...

MAL-2026-14418 Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...

Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...