Malicious code in knip-bun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d412258df9a21f510333926a9be29bed8ae6368e549e295c84e187bdc1a3725 Package knip-bun typosquats the popular knip linter. The main module is an empty stub module.exports = , and package.json declares a dependency...

MAL-2026-13958 Malicious code in power-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823 power-assert-plus is a typosquat of power-assert. On every require, index.js detach-spawns node build/power-assert-plus.js. That build file is...

Malicious code in power-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823 power-assert-plus is a typosquat of power-assert. On every require, index.js detach-spawns node build/power-assert-plus.js. That build file is...

Malicious code in bs58-77 (npm)

npm/bs58-77 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-77x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-77x as a runtime dependency declar...

Malicious code in @openzeppelin-5/contracts (npm)

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v5 line via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

MAL-2026-13258 Malicious code in bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, usernam...

MAL-2026-13349 Malicious code in mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8871a9cd738ee7dbe2245e741d52afb659069bc6fcc7d5aa6cfb87bfad9dbcd On require, index.js serializes the full process.env along with hostname, username, homedir, platform, and cwd, base64-encodes the JSON blob, and...

MAL-2026-13214 Malicious code in @zzzcrypto/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ceac45508e2f9506a082b2195d3bae4b046f096d11856d72ea53f784ad5992e @zzzcrypto/[email protected] is a typosquat/impersonation of @solana/spl-token README self-describes as a 'drop-in replacement'; author metadata...

MAL-2026-13322 Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in devplatform-nx-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4cd991fb1b5e2308797829d38de8ba8b673c91a889e800621d01faef34610d devplatform-nx-husky is a typosquat blending the nx and husky ecosystem terms; its exported class is an inert no-op and the package has no legitimate...

Malicious code in rollup-plugins-polyfills-rode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09fa29e5d68238ff42feaba875bbfe1dbeed5214478a811e504bbed05bf7797d [email protected] is a typosquat of rollup-plugin-polyfill-node whose repository URL it copies verbatim into its own package.json...

Malicious code in table-ui-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a [email protected] ships dist/config.js, exposed via the package.json ./config subpath export, which exports a module-level array named HASHES...

Malicious code in post-css-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4 post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On...

MAL-2026-12417 Malicious code in post-css-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4 post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On...

Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

Malicious code in react-fontawesome-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4706d295cdd6ae07918ab25d54475d97d88e92c8ba2d3923078ba916096b4366 The default-exported React component in [email protected] performs an unconditional axios GET to http://command.control on every render a...