Malicious code in layer2-sdk (npm)

Source: amazon-inspector 1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f index.js line 75 decodes a base64-encoded string via Buffer.from..., 'base64'.toString'utf8' and passes the result to an evaluator, executing hidden code when the module is loaded. The obfuscated-and-exec'd...

MAL-2026-14290 Malicious code in anhn-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657 bin/install/install.js appends a heavily obfuscated top-level IIFE obfuscator.io-style rotated string array 0x240a/0x4963 with arithmetic index...

Malicious code in anhn-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657 bin/install/install.js appends a heavily obfuscated top-level IIFE obfuscator.io-style rotated string array 0x240a/0x4963 with arithmetic index...

Malicious code in @wizloft/harness-kernel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d73d94752604c9b48dd785c20cee875e268bb52c673bf3817f95000830fa85 dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints eth.drpc.org,...

Malicious code in @wizloft/harness-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554 dist/index.js the package's declared main contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. ...

Malicious code in mc-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc Package publishes as mc-registry with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the...

MAL-2026-14291 Malicious code in libas-signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eeb8f4b0a4f0f66d8a5cfdbc132ec7244b9f9f5948e337dd6b937521663e7c25 On require of libas-signal, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites...

MAL-2026-14278 Malicious code in layer2-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f index.js line 75 decodes a base64-encoded string via Buffer.from..., 'base64'.toString'utf8' and passes the result to an evaluator, executing hidden...

Malicious code in layer2-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f index.js line 75 decodes a base64-encoded string via Buffer.from..., 'base64'.toString'utf8' and passes the result to an evaluator, executing hidden...

Malicious code in mutex-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...

Malicious code in mutex-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c015af803d9d4adc7d0578dc27795ebaef48e6ce25e9bf715b54af1e4991999 The package is published under a name resembling the popular async-mutex library and, beyond advertised mutex functionality, contains a staged loader...

GHSA-V5RC-CPWC-CFPR

creationtimestamp| type| source ---|---|--- 2026-08-19 07:31:59+00:00| seen| https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad...

Malicious code in karma-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379b8e968c18bc5df2f2e00ad56f6c1c139bc97d4a8b19e6d1a917398ad72e58 On npm install, the package's postinstall lifecycle script collects host identifiers os.hostname, platform, arch, Node.js version, package name,...

MAL-2026-14268 Malicious code in no-for-of-loops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5 package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops...

Malicious code in no-for-of-loops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5 package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops...

MAL-2026-14269 Malicious code in novel-suduko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...

Malicious code in novel-suduko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...

Malicious code in de-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f package.json declares both a dependencies and devDependencies entry for de-morgan pointing at http://pack.nppacks.com/npm/de-morgan, a non-npm-regist...

Transform Chain

Stack multiple stream transforms comma-separated module paths. !/usr/bin/env python3 -- coding: utf-8 -- """Composable transform chain — stack multiple stream transforms on one C2 channel.""" from future import annotations import importlib import re from typing import List, Optional from...

MAL-2026-14261 Malicious code in postcss-initialize-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16 [email protected] presents itself as a PostCSS plugin README, badges, and repository links reference the legitimate...