Malicious code in abuden23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a3dd35665bdd420f175b6b522ef75b800e178d26b62971b55b20891e5663c0c The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45385ab2d7ac9fcd5f37a9faa2824beba492422d1783deef1b9b153eda2e25d2 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fec8592c01e9729b2d3eff199c34b71f489e593a095226c95b237d35ccfcc6f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in abuden3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24491a69d293bf42c8f7a0f379f5e77600880d2fcd9c5b5ce9f0021b07b987f1 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2505cd60f257bd1c69e2bd6ccbaa987e2045a453adb8c0e1c529c34afade95c7 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570cc848bb0e31176fc13945f1cfbd39b64a671de7e2d1913b6951513c0b21b8 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec6b68489cb95001c5971ace33533e31169126fb141feea65e198756e66c05c The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f04a1305b1d162f7958092deffd5a8ad485daf0d64b2d52b26c92d5f1a1db2 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49cfb64273573166bc38b5ef83b722b3a264c8e19870fc65b35eaaa5504a69bf The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248f82bac5fecfd3cc8e27d3c4cc6f48f310aef9c069e64cc33a407cd79369bb The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10368 Malicious code in ratelimitsucks3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a45b50938677bb4c4bcdeee48af3fd57a8204d48d6aff16a1351ae814491391 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10335 Malicious code in miguelphonk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75c26ae2a9608c5a861f096563a0ef1171cb898403537612739792024abcc2ff The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ishowfeet4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8772abfff8be97e21dacda47b1a535bea90b6793740846a30308d75c3b2f655b The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in speed5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eec0d2d56f1e9730af8b7f3a7b8897e86491d48663f7b09ae7c716f6b3c0092 [email protected] is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker importScripts'./8cfc2/hgshm.js...

Malicious code in imillegal4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e410fdca18f0aedc18130966449a52dce6ecc481c6d8c7b823764f09146d625 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc732922556c087a288d536adf6ef6bf7d643946239cd9563e0a9bc9b6960205 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in backupsitetuff9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19023e9ea0dfa0d26e43e282c2238e33aa89d73921279d5838ae18767cbca871 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in imillegal1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b8bddd4b8345bfaacf5ad511276da43344de0033bc312123620aa6cc6e4366 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in timmytuffknuckles9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 342d7a44db99769023685647376a6042d5a9b345c281826484c9d88561f245ca Package is not a Node library — package.json declares main: sw.js, a browser Service Worker whose first line calls importScripts'./8cfc2/hgshm.js'...

MAL-2026-10326 Malicious code in ishowfeet5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f3dc5dbca240ed6fabdb431e41494dd64100dbf96791921a36642cb53a9403 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...