MAL-2026-16276 Malicious code in @lekzo/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da5caafea4a5656343feb4b52bf0007c98e6ed65a41ad22c79f24c0f1c48566f package.json declares the libsignal dependency as github:canove/libsignal-node — a bare GitHub owner/repo reference with no commit SHA, tag, or semve...

MAL-2026-16155 Malicious code in ultra-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...

Malicious code in @nexustechpro/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77e10f9b682c7a34a63468b31a47d982a98bf6d0308b5dbe96b0df7bdb51fdd6 @nexustechpro/baileys is a fork of the Baileys WhatsApp library in which lib/Socket/chats.js 270 KB is transformed with obfuscator.io large...

MAL-2026-16104 Malicious code in @nexustechpro/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77e10f9b682c7a34a63468b31a47d982a98bf6d0308b5dbe96b0df7bdb51fdd6 @nexustechpro/baileys is a fork of the Baileys WhatsApp library in which lib/Socket/chats.js 270 KB is transformed with obfuscator.io large...

Malicious code in @neroxkira/vangal-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af1543fb92f079191de134bd36dbb64c340928804df8486acf43546e2c6e185 package.json declares libsignal with the source github:RILLYZY/libsignal-node, an unpinned reference to a third-party GitHub repository with no tag o...

MAL-2026-16103 Malicious code in @neroxkira/vangal-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af1543fb92f079191de134bd36dbb64c340928804df8486acf43546e2c6e185 package.json declares libsignal with the source github:RILLYZY/libsignal-node, an unpinned reference to a third-party GitHub repository with no tag o...

Malicious code in mfatest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...

MAL-2026-16102 Malicious code in mfatest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...

MAL-2026-16057 Malicious code in toru-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...

Malicious code in toru-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...

Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

MAL-2026-15868 Malicious code in @bx-ui-framework/microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30 package.json declares a runtime dependency microfrontend whose source is a bare HTTPS URL at...

Malicious code in mfaatest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e4ce261829117e316f9152160cdcb35c6ba66064f631baba1f8d528673b584 package.json declares dependency node-net-pool with its value set to an arbitrary HTTPS tarball URL...

MAL-2026-15536 Malicious code in ir-annuities-client-authentication-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d813fc9c0831847a602c97803b7e53603edfb6acef4386e4cde2927c2a7a297 package.json declares a dependency whose key equals the package's own name ir-annuities-client-authentication-module and whose value is a plain HTTPS...

Malicious code in paper-password-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a97853ce25938b0cc295a798fa8c9ae8ab513126e70b93084785636a91bc7ec4 package.json declares a dependency whose key equals the package's own name paper-password-input and whose value is a bare HTTPS URL,...

Malicious code in aura-instrumentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14004b53bc245039cad1473ab4a95c2b2c8fcff2acc4b5f2c0f868da63e103bd package.json declares a self-named dependency 'aura-instrumentation' whose source is the bare URL https://repo.securityctrl.com/aura-instrumentation...

MAL-2026-15527 Malicious code in aura-instrumentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14004b53bc245039cad1473ab4a95c2b2c8fcff2acc4b5f2c0f868da63e103bd package.json declares a self-named dependency 'aura-instrumentation' whose source is the bare URL https://repo.securityctrl.com/aura-instrumentation...

MAL-2026-15541 Malicious code in oit-lib-oracle-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63a2d32099a0c4246e0b8711f8b29d321b7d1c3a0a99e36edc367934fc9f34f3 package.json declares a dependency whose key oit-lib-oracle-util matches this package's own name and whose value is a bare HTTPS URL —...

Malicious code in jsb-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368bba2e9d134a0d1ce565627644361ebe98bbf7bc2fd04812ff7137c300eaac package.json declares a dependency whose key jsb-adapter equals this package's own name and whose value is the bare HTTPS URL...

Malicious code in alimama-minisite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efd48d631afe828271bb266e4ddb8f2f6d0a8305294f56bde57d614c1cbfef package.json declares a self-named dependency alimama-minisite whose value is the off-registry URL https://repo.securityctrl.com/alimama-minisite...