MAL-2026-5186 Malicious code in autotel-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49899c545b0d4535885123c5d0bd0ba8804da194fc196e950fbf813518ff08a8 The package ships a bundled CLI dist/cli.cjs and dist/cli.js in which base64 decoding primitives Buffer.from..., 'base64'.toString... co-occur with...

Malicious code in autotel-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49899c545b0d4535885123c5d0bd0ba8804da194fc196e950fbf813518ff08a8 The package ships a bundled CLI dist/cli.cjs and dist/cli.js in which base64 decoding primitives Buffer.from..., 'base64'.toString... co-occur with...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...