MAL-2026-13784 Malicious code in bgncvhferucfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1bf8639ccc5d2a70ae2e0ce754b76e1ca525699413f5d696289714005e86c57 The package's sole content is a single obfuscated HTML file declared as main. When loaded in a browser, the page renders a fake Cloudflare Turnstile...

MAL-2026-13811 Malicious code in hcfguyfrmblp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f806fc6db71a1b888ba1f86d790b7a2866b4911e7f77ade2d375237e8c0a6ea2 The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page mimics a Cloudflare...

Malicious code in khanbmnxls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2170fddb23040b2e55eeeb17188244072efdef033879036b45865f5b84ef7346 The package contains a single index.html that impersonates a Cloudflare Turnstile 'Just a moment...' challenge page. The inline JavaScript is heavily...

Malicious code in vkldhcmieru6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25890a37fa8da48d2dc2868e010cef8cb3427faa42218cec4b858ac82db679d7 The package contains only index.html declared as main in package.json and a minimal package.json with no lifecycle scripts. The HTML impersonates a...

Malicious code in xhjckswqivb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a9d37b433e22c980e67c0a2991612592959f6998df3928a6a09792ecf4860bb Package contains only index.html and package.json. The HTML mimics a Cloudflare Turnstile challenge and, when loaded in a browser, assembles an...

Malicious code in clxofwfjskaz7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b4dde997a29794d4dfbb4725da833fa7cb4a221dc91d6b820901745eb77f198 The tarball contains only package.json and index.html. package.json declares main: index.html and no lifecycle scripts...

Malicious code in fghvbmniwu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8623e3b9a84e8cbe5910bc3d683f19629c49b9d3f0a2e00ab771901efef8146a Package contains a single index.html declared as main, which is a Cloudflare-branded 'Just a moment...' clone embedding a Turnstile widget and heavil...

Malicious code in xcnvjfsiewlk9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062503dc8980c1ade02ac4fc0566a94d40b85c0a634da8b00a941f9acfcf9747 The package's sole content is an index.html disguised as a Cloudflare Turnstile 'Just a moment...' verification page. The HTML contains...

Malicious code in cvbniydplwe3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9edbef37139b40a366aacea90abbd4b80ca581921f213b98ffb17db3b857bfcd The tarball contains only index.html declared as package.json main and no JavaScript, no lifecycle scripts, and no Node-executable entry point...

MAL-2026-13820 Malicious code in khanbmnxls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2170fddb23040b2e55eeeb17188244072efdef033879036b45865f5b84ef7346 The package contains a single index.html that impersonates a Cloudflare Turnstile 'Just a moment...' challenge page. The inline JavaScript is heavily...

MAL-2026-13843 Malicious code in xcnvjfsiewlk9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062503dc8980c1ade02ac4fc0566a94d40b85c0a634da8b00a941f9acfcf9747 The package's sole content is an index.html disguised as a Cloudflare Turnstile 'Just a moment...' verification page. The HTML contains...

MAL-2026-13837 Malicious code in unitel3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191a863f69cdac20d9594e012bfb03929448786892a1c13d185ac4f64d2b5a8f Package [email protected] contains 2 files. No install-time lifecycle hooks, credential access, network exfiltration, dropper, or backdoor behavior was...

MAL-2026-13830 Malicious code in nihzvdeowx5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 303f930ccf841284aaa263af6244d308d3bfd0d83b5af6ae037ff634f2518d94 The package contains only index.html declared as main in package.json and no JavaScript entry point, lifecycle scripts, or other module code. The HTM...

Malicious code in yangming8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c011964f9503dad45858ba2fdd5de1303275d7a0a680e2c482c3e14d90c4e33c The tarball's only shipped file is index.html, declared as the package's main. There are no lifecycle scripts, no JavaScript entry point, no...

Malicious code in csbcldfvivwfgd4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6d7db017a0499c0fca67cc331c44fa736fe52568177990823cb17bd03ceee21 The package contains a single index.html declared as main. The HTML mimics a Cloudflare 'Just a moment...' challenge and contains obfuscator.io-style...

Malicious code in mnchfnvbue1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff948b6e989a38a47cbb12d4e633d48a2069c04bb64066d66140f3b27835ef86 The tarball contains a single file, index.html, declared as the package main. The HTML contains heavily obfuscated JavaScript that mimics a Cloudflar...

Malicious code in ms_aidc_com_tw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12bdd45f103beeee602be82a07277a3f0cb842ec3a9829e904911fe37bd2fd5 The package msaidccomtw ships only an index.html that renders a fake Cloudflare Turnstile 'security verification' page. On Turnstile completion,...

Malicious code in fhj8cv9dkwm4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91ea4120fcb82c9a36d533346c28a2ce7ed225ed31a89526d9cee45f0be2581 Package ships a single index.html that mimics a Cloudflare Turnstile 'Just a moment...' verification page. An obfuscated obfuscator.io-style script...

MAL-2026-13807 Malicious code in fdhcvriwecv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72894ed6ed82e4ebcbd83619b2a3f591c7dab355050fc1d43a62f90d384ee08 The tarball contains only package.json and index.html. package.json declares main as index.html, and there are no...

MAL-2026-13845 Malicious code in yangming708 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f670e6c07175c9534c5554cc89c44a73a22d46a18a9a19140030b5b446fba17f The tarball contains only package.json and index.html. package.json declares main: "index.html", which is not a requirable Node module, and no...