MAL-2026-11442 Malicious code in @mp-op-ss-front-lib/tracks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d870b0214c38734a6a9b3073e958bb198a11243a3093110cc85be0b7ae9bdb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11438 Malicious code in @fuji-web-components/maps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d5e567a52783d2e684e1da23e3d5804652801f44f643834fcb30cea6bbab732 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11436 Malicious code in @finance-ui/finance-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b752ae2cd0e6a1f9faf2b0c3376aa390e9708b86705621087e72e95de4333448 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in metrics-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...

Malicious code in @cr-invested-ui-components/chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c6439b3541927d90da8118ef84eda4e7bedf70c59293c1dc695bb2219135cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11473 Malicious code in metrics-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...

Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

Malicious code in refbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...

MAL-2026-11477 Malicious code in refbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...

MAL-2026-11466 Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

Malicious code in iwomm-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc6a86a4bd25e85d55ccc7babe614b8cf8eb1b31572b67b1f463ad0302263669 lib/report.js imports childprocess, fs, https and os, collects host and user identity data via os.hostname and os.userInfo lib/report.js lines 160-16...

Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ee88b53e786db18609f7956c556a7f814b476c895bb90d5663aedc82ca14f0 Package name 'mcp-server-boilerplate' is unrelated to the Model Context Protocol ecosystem it evokes; the shipped code is a data-collection payload...

Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

Malicious code in paraglide-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22f62eaf75227ca79ee8d113b790e60589d2f29204db3e6f3939e3dd3c7527cf Package name closely resembles the widely used @inlang/paraglide-js i18n library, but the declared main entry index.js is only a helloWorld stub. The...

MAL-2026-11474 Malicious code in paraglide-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22f62eaf75227ca79ee8d113b790e60589d2f29204db3e6f3939e3dd3c7527cf Package name closely resembles the widely used @inlang/paraglide-js i18n library, but the declared main entry index.js is only a helloWorld stub. The...

MAL-2026-11459 Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...

MAL-2026-11458 Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...

Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...

MAL-2026-11464 Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...