MAL-2026-14162 Malicious code in axious-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25 axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte...

MAL-2026-14181 Malicious code in lodahsjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318 Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it...

Malicious code in fast-glob-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408 fast-glob-fast is a name-squat of the popular fast-glob package its repository field even points at mrmlnc/fast-glob. The declared postinstall hook...

MAL-2026-14157 Malicious code in typscript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945 typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte...

Malicious code in typscript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945 typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte...

MAL-2026-14154 Malicious code in typesript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac32bb6c3db806740bda125cf58a8f348256baa021b0a6c7b901ebb86720505 Package name is a one-character typosquat of the widely-used 'typescript' family. On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a...

Malicious code in typesript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac32bb6c3db806740bda125cf58a8f348256baa021b0a6c7b901ebb86720505 Package name is a one-character typosquat of the widely-used 'typescript' family. On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a...

Malicious code in typesript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b6f2a112a6a6d3b065b205c4cbb1d8183340054a2d57d7697360e30dbdccd9 [email protected] is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is...

Malicious code in typescrit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adcb90c6a48b3b20928967d1aea32cde54035ed455c474a6db4fab148b424b53 On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a hidden URL that resolves to an unrelated personal GitHub account...

Malicious code in typescirpt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef20a464d9f616eecfd6457a02895da80d1fabf558ef49de83dca18046551e90 Package name 'typescirpt-core' typosquats 'typescript'. scripts/postinstall.js runs automatically on npm install and posts a JSON platform beacon to ...

MAL-2026-14149 Malicious code in typescirpt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef20a464d9f616eecfd6457a02895da80d1fabf558ef49de83dca18046551e90 Package name 'typescirpt-core' typosquats 'typescript'. scripts/postinstall.js runs automatically on npm install and posts a JSON platform beacon to ...

Malicious code in typescrip-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44399cd197dfa6f24adf7c96a380d2e0c95a4123d8c14932ceb0a85e32ebc9b9 Package name 'typescrip-cli' typosquats 'typescript-cli'; index.js exports an empty object and the package has no library functionality...

Malicious code in typescirpt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09d82fa51e42e6766fe0819517e9fb5be633702a0e22cb4da05d8920cb413c53 The package's postinstall script scripts/postinstall.js XOR-decodes obfuscated byte arrays using the key 'stf2026' to reconstruct a download URL and ...

MAL-2026-14151 Malicious code in typescriptt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 023f754538f603fbb5379ee8be82cb9524f710495e5dddc4e631e5aafbf323b5 typescriptt-cli is a typosquat of typescript-cli whose index.js is an empty module; its only real behavior is in scripts/postinstall.js. On npm...

MAL-2026-14144 Malicious code in tyepescript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ba91f9b227b017ddbfa6a908a0a8f0263292a0af2c11aeef0ccd24b2894862 Package name 'tyepescript-core' is a typosquat of 'typescript'; the module itself exports an empty stub. scripts/postinstall.js XOR-decodes byte arra...

MAL-2026-14147 Malicious code in typescipt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b97af3a328b837904c7860b7acbae33bea28afb53949905868867905c14be6 Package name typosquats typescript. The postinstall script scripts/postinstall.js XOR-decodes a download URL and a PowerShell launcher using key...

MAL-2026-14146 Malicious code in typescipt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b080f58ace02e860729134afd887943345248628e5c201a5fd2e46c71f439d29 Package name typosquats 'typescript'. scripts/postinstall.js runs at npm install time and: 1 POSTs a JSON body with the installer's platform label to...

Malicious code in mtslink-depconf-probe-profileusername (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f679922753b7a59c59af851ae74275b5d4760b13fc516bc8c68e8e9568393dc6 Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.c...

Malicious code in optimizely-starter-kit-for-fastly-compute (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...

WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by PPzzAArr in WordPress Plugin PublishPress Series versions = 2.17.0...