MAL-2026-17176 Malicious code in n8n-nodes-moonlet-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec Package presents itself as n8n helper nodes but ships an empty stub index.js module.exports = and no functional node modules. On npm install,...

Malicious code in n8n-nodes-moonlet-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec Package presents itself as n8n helper nodes but ships an empty stub index.js module.exports = and no functional node modules. On npm install,...

Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

MAL-2026-13651 Malicious code in sme-rko-finance-front-operations-widget-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1cadf7bdbe8322e1878572d42f769a267d9a2af7a61c0da00f02c1436799824 index.js requires./setup on load, which selects a platform-specific binary path linux/darwin/win32 and fetches an opaque native executable from one o...

Malicious code in sme-rko-finance-front-operations-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js...

MAL-2026-13585 Malicious code in dolyame-ui-inputtag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8 On require of the package's main entry, index.js loads init.js which downloads a platform-specific executable from hardcoded oob-worker..workers.dev...

Malicious code in dolyame-ui-postcsscustomproperties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8be08d3eb5601ca7f7b5f74c34e3fd0ebba91f0b72dea8ab4b0642bb9695c0c On require of the package, shim.js and lib/telemetry.js reached via the main entry select a platform-specific payload, download a binary over HTTPS...

MAL-2026-13506 Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

MAL-2026-13228 Malicious code in bigops-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5 [email protected] executes a binary dropper at require time. index.js loads./init on import; init.js assembles C2 hostnames from split string arra...

Malicious code in bigops-storio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split...

Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...

MAL-2026-13260 Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...

Malicious code in devplatform-supafetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally...

MAL-2026-13294 Malicious code in dolyame-boxy-atom-desktop-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2 On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

MAL-2026-13306 Malicious code in dolyame-boxy-desktop-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656 On require of this package, index.js loads compat.js which selects platform-specific endpoints assembled from split string arrays e.g...

MAL-2026-13323 Malicious code in dolyame-boxy-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0512db79eba207153d2427271566e3ecd016d3d817266e683a801d82183254e9 On require, index.js loads ext.js which detects platform, constructs C2 hostnames by joining split string fragments e.g. "oob-worker.cf99-9b3.worker"...

Malicious code in dolyame-boxy-independent-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273880296b11c362e48b0d7b6d2795c56f8726937482462bee9e615943572d46 On load, index.js unconditionally requires platform.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf.workers.dev with...

Malicious code in dolyame-boxy-mobile-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180d09900ce4462a9d4c9b47dcc26491bfb50aacd5a226a3571211007edb3ad2 index.js unconditionally requires./setup on module load. setup.js branches on process.platform linux/darwin/win32, fetches an opaque binary from...

Malicious code in dolyame-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310 [email protected] is advertised as a React UI color library but its main entry requires./shim.js on load, which acts as a platform-aware binar...

MAL-2026-13147 Malicious code in dolyame-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a8bea0bf750cf5c6be413201bef52e6f8e174f7e8f954abc933aedad216310 [email protected] is advertised as a React UI color library but its main entry requires./shim.js on load, which acts as a platform-aware binar...