MAL-2026-14178 Malicious code in ladash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js,...

Malicious code in commandorjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b [email protected] is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js,...

MAL-2026-14174 Malicious code in commandorjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b [email protected] is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js,...

MAL-2026-14164 Malicious code in bqq1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8709cb6f826b8ee95c1d8aef1bb12c769c165260483b6a95be782af9dbeb2ba The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On...

Malicious code in bqq1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8709cb6f826b8ee95c1d8aef1bb12c769c165260483b6a95be782af9dbeb2ba The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On...

MAL-2026-14170 Malicious code in comander-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626 comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All...

Malicious code in comander-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626 comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All...

Malicious code in axious-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25 axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte...

MAL-2026-14162 Malicious code in axious-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25 axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte...

MAL-2026-14181 Malicious code in lodahsjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318 Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it...

Malicious code in lodahsjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318 Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it...

espectre snapshot-dev

🛜 ESPectre 👻 Motion detection system based on Wi-Fi spectre analysis CSI, with native Home Assistant integration via ESPHome. !TIP New ML Detector : Neural network-based motion detection. No calibration required, runs on-device. This is an experimental feature, and feedback is welcome in the...

MAL-2026-14142 Malicious code in testingsmthb1g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04fa6b8b5826315448e5d4f27036ab31ef115621027c040897e200894c43dfa3 scripts/postinstall.js runs at npm install and performs an install-time dropper chain. A URL stored as an integer array is XOR-decoded key 'stf2026' ...

Malicious code in testingsmthb1g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04fa6b8b5826315448e5d4f27036ab31ef115621027c040897e200894c43dfa3 scripts/postinstall.js runs at npm install and performs an install-time dropper chain. A URL stored as an integer array is XOR-decoded key 'stf2026' ...

Malicious code in typscript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945 typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte...

MAL-2026-14157 Malicious code in typscript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945 typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte...

Malicious code in typscript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1425e6f0bb2305eeddecaab5403e09ead0e8f60b9b1f817581a343cb5a3dd062 typscript-cli is a typosquat of 'typescript' index.js exports an empty object; no library functionality. Its scripts/postinstall.js is the only...

MAL-2026-14156 Malicious code in typscript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1425e6f0bb2305eeddecaab5403e09ead0e8f60b9b1f817581a343cb5a3dd062 typscript-cli is a typosquat of 'typescript' index.js exports an empty object; no library functionality. Its scripts/postinstall.js is the only...

MAL-2026-14155 Malicious code in typesript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b6f2a112a6a6d3b065b205c4cbb1d8183340054a2d57d7697360e30dbdccd9 [email protected] is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is...

Malicious code in typesript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b6f2a112a6a6d3b065b205c4cbb1d8183340054a2d57d7697360e30dbdccd9 [email protected] is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is...