MAL-2026-12512 Malicious code in appsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff26e8c679b4035612af78043157ee418aac37aab4eebc5ba54a6e60f204e95c Package name appsignal shadows the legitimate @appsignal/ scope and is published at version 9999.0.0, a version-number pattern used to outrank...

MAL-2026-10115 Malicious code in fmt-date-lite (npm)

The npm package fmt-date-lite is a supply-chain dropper disguised as a benign date-formatting utility its description reads "Lightweight date formatting utility with locale support". It ships six files, no source repository and no dependencies, with its real behaviour in an install script. A...