MAL-2026-14432 Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

MAL-2026-13413 Malicious code in @astralcore/aura-wb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4a1b22725e981c18c44de0f81915a5048b58bdcacfe6935c9dfcb3dceb641c The package is a WhatsApp Baileys bot whose default configuration in config/index.js points MONGODBURI at a hardcoded shared Atlas cluster...

MAL-2026-13364 Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b1477c5187703dab87d6be6933d62de4c4244ab3340586f85b530e05470aa1 Package ships an agent daemon vanexa-agent start, entry bin/vanexa-agent.js that receives commands from a remote phone app and executes them on the...

MAL-2026-13327 Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts...

MAL-2026-13340 Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb The package's main entry index.js requires./compat, which at import time downloads a platform-specific executable from author-controlled endpoints...

Malicious code in bnpl-blocks-mobile-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be8101254611004c84932cd102d4fb71dc7e692d67696df081e66bd37ba3088b On require, index.js loads support.js whose top-level main downloads a platform-specific binary from author-controlled hosts assembled via string-arr...

MAL-2026-13004 Malicious code in bnpl-blocks-mobile-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a76b1d07f3d0357fa471ba2b1e5a0052b1b789f96763446a20e19cf7ac7ab11 On require of the package, index.js loads bootstrap.js which fetches a platform-specific binary payload over HTTPS from author-controlled hosts whose...

Malicious code in uploader-frontend-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681 The package's scripts.install runs node index.js, which loads lib/core.js and issues a dns.resolve4 query against a subdomain of oob.sl4x0.xyz...

MAL-2026-4696 Malicious code in turing-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01af0d34d23b6ed4e61390a21baec8c1bb81080c04945293a7e4ba8d20277ca6 package.json declares turing-code as an HTTPS tarball dependency at https://turing.tap365.org/v1.1.2/turing-code-1.1.2.tgz, bypassing the npm registr...

MAL-2026-4364 Malicious code in @aswinsparky/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cceefd98563e2885501c896472471f2bb20b77103ad99c253775570cae6b4fe index.js line 11 issues a fetch to the hardcoded URL https://api.aswinsparky.qzz.io carrying values read from process.env. The destination is a...

Malicious code in aurafarmer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 967bdc07ba43b92a320ad0ef81975a5547d24b987eda5b8cdf863fc7c18245e0 The package advertises an aurex CLI. Its login flow aurex/main.py around line 108 prompts the user for email and password and POSTs them as JSON to a...

MAL-2026-3684 Malicious code in @gusmano/reext (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 498a21b60dcdfe236ea0b1683e1ec64aa091643b6ad562c3845757eed79660d8 The npm preinstall lifecycle script dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/preinstall.js" reads the...

Malicious code in always-updates (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee16a964c16035579f7be2f965a801f87876080603f389e1e75ec3073bd5c2c The package's sole advertised CLI aupd, registered as a consolescripts entry point to alwaysupdates.main:main executes...

MAL-2024-12269 Malicious code in faest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f66b290465d72fc55bce4fef4200ebea68c430be84cdcbbabec5263958041781 When using this library to do any request, a "validateorigin" function is called L1320 in client.py. This method, located in utils.py, collects all request dat...