MAL-2026-11453 Malicious code in adpanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e99205329e726e32ed6884b52666e69e3327134c257dd1025464fed2fb461bf lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, reads local files via fs.readFileSync,...

Malicious code in adpanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e99205329e726e32ed6884b52666e69e3327134c257dd1025464fed2fb461bf lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, reads local files via fs.readFileSync,...

Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...

MAL-2026-11481 Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...

Malicious code in attio-discover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db27d7cbc4d04670f5b2d1e199294b46fd92375598b362f501010c0cc1eddf9 The package's postinstall hook invokes lib/report.js, which harvests the developer's email queried via gh api user/emails, git config, npm config, an...

MAL-2026-11456 Malicious code in attio-discover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db27d7cbc4d04670f5b2d1e199294b46fd92375598b362f501010c0cc1eddf9 The package's postinstall hook invokes lib/report.js, which harvests the developer's email queried via gh api user/emails, git config, npm config, an...

Malicious code in hazmat-cfr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 670ac0a193b6b9a6afb01457c68700468026e76943f07cdf100d2d85601be2b3 lib/report.js reads local files fs.readFileSync at lines 31 and 72, collects host and account identifiers via os.hostname and os.userInfo lines 160,...

Malicious code in capacitor-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02650efb5b0f2e8ca581f927c0ca3e50966bc8b425e81a6e2dc9f45c70234422 Package name typosquats the legitimate @capacitor/assets. On postinstall via postinstall.js invoking lib/report.js, the package collects developer...

MAL-2026-11457 Malicious code in capacitor-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02650efb5b0f2e8ca581f927c0ca3e50966bc8b425e81a6e2dc9f45c70234422 Package name typosquats the legitimate @capacitor/assets. On postinstall via postinstall.js invoking lib/report.js, the package collects developer...

MAL-2026-11465 Malicious code in hazmat-cfr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 670ac0a193b6b9a6afb01457c68700468026e76943f07cdf100d2d85601be2b3 lib/report.js reads local files fs.readFileSync at lines 31 and 72, collects host and account identifiers via os.hostname and os.userInfo lines 160,...

MAL-2026-11470 Malicious code in kip-mcp-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd2c47d8520d4f3bbff232ba1143fdbf7f64f1fa31a70f91be117714d19455e2 lib/report.js imports childprocess, fs, https, and os and, via execSync plus fs.readFileSync calls, gathers host identifiers os.hostname, os.userInfo...

Malicious code in kip-mcp-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd2c47d8520d4f3bbff232ba1143fdbf7f64f1fa31a70f91be117714d19455e2 lib/report.js imports childprocess, fs, https, and os and, via execSync plus fs.readFileSync calls, gathers host identifiers os.hostname, os.userInfo...

Malicious code in pm-claude-skills-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce00c3df3f5fdc8df05a880bb2abd711a8e1d7352b8067ef88d70d353e825e3c lib/report.js imports childprocess, fs, os, and https, then collects host and user identity data via os.hostname and os.userInfo, reads local files v...

MAL-2026-11475 Malicious code in pm-claude-skills-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce00c3df3f5fdc8df05a880bb2abd711a8e1d7352b8067ef88d70d353e825e3c lib/report.js imports childprocess, fs, os, and https, then collects host and user identity data via os.hostname and os.userInfo, reads local files v...

MAL-2026-11462 Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...

MAL-2026-11468 Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11486 Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...

MAL-2026-11476 Malicious code in polyprompt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52da21b792fba3cc472cb67f1a5b445786802d67b6cf81b45409acdab8724c17 lib/report.js resolves the installer's git/GitHub email through gh api user/emails, git config, npm config, and environment variables, then POSTs a...

MAL-2026-11480 Malicious code in routerbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f468779704fb38dd80ed26eabb01f4afdfef486ebb645d99fc07c36dcb479cf The package published as 'routerbase-mcp' declares a bin named 'install-email-research' and ships lib/report.js which collects the installer's email...