Malicious code in ssb-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 086e13ef78d9987210a95cc9e70359d982cd9dbffa59d674d6f5ed3cb8f8a725 [email protected] is a dependency-confusion proof-of-concept. package.json declares preinstall: node poc.js, and poc.js runs unconditionally on...

MAL-2026-14221 Malicious code in ssb-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 086e13ef78d9987210a95cc9e70359d982cd9dbffa59d674d6f5ed3cb8f8a725 [email protected] is a dependency-confusion proof-of-concept. package.json declares preinstall: node poc.js, and poc.js runs unconditionally on...

Malicious code in streak-cal-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287 index.mjs the package's main entry contains a 500 KB base64-encoded x86-64 ELF payload stored in a store array disguised with a // --- Calibration Da...

MAL-2026-14222 Malicious code in streak-cal-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287 index.mjs the package's main entry contains a 500 KB base64-encoded x86-64 ELF payload stored in a store array disguised with a // --- Calibration Da...

Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...

MAL-2026-14223 Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...

Malicious code in streak-metric-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77 [email protected] ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs...

MAL-2026-14224 Malicious code in streak-metric-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77 [email protected] ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs...

MAL-2026-14209 Malicious code in sui-gql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33 On require, lib/telemetry.js runs a top-level IIFE that reads the installer's /.gitconfig, extracts the configured email addresses and user name,...

Malicious code in sui-gql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33 On require, lib/telemetry.js runs a top-level IIFE that reads the installer's /.gitconfig, extracts the configured email addresses and user name,...

Malicious code in sysc1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json main is index.js which invoke...

MAL-2026-14214 Malicious code in sysc1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json main is index.js which invoke...

Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

MAL-2026-14212 Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

MAL-2026-14211 Malicious code in sw-pluginer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06 sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config vi...

Malicious code in sw-pluginer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06 sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config vi...

MAL-2026-14208 Malicious code in eth-batcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599 index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a 149 KB obfuscated Function... payload concatenated onto the module.expor...

Malicious code in eth-batcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599 index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a 149 KB obfuscated Function... payload concatenated onto the module.expor...

Malicious code in @lilsccott6x9/devpipe-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f The package's postinstall lifecycle hook package.json declares postinstall=node scripts/setup.js decodes base64-encoded shell command strings and...

MAL-2026-14203 Malicious code in @lilsccott6x9/devpipe-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f The package's postinstall lifecycle hook package.json declares postinstall=node scripts/setup.js decodes base64-encoded shell command strings and...