Malicious code in lodhash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73ad64f6c3a93b504c64c10175e325463652fafd741c36cfad433bed93f24cc8 lodhash-cli is a lodash-typosquat whose main entry index.js exports an empty object; the package's only behavior is a postinstall dropper...

MAL-2026-14183 Malicious code in lodhash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73ad64f6c3a93b504c64c10175e325463652fafd741c36cfad433bed93f24cc8 lodhash-cli is a lodash-typosquat whose main entry index.js exports an empty object; the package's only behavior is a postinstall dropper...

MAL-2026-14166 Malicious code in chalk-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js. On install the script XOR-decodes...

Malicious code in streak-math-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ba4f1a9b23ca375fed98868d8ca488ec722b473060834412b0b1b23f5cae37a [email protected] is advertised as a math primitives library but its index.mjs top-level IIFE bootstrap runs on any import and drops a hex-embedd...