MAL-2026-17550 Malicious code in css-dwsawd-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c370cda09695e44d06a44bc14d14817edadc047e4dad0314edcfc752be796e9 The package name mimics a Wix thunderbolt polyfill and ships a registry-manifest.min.json that aliases legitimate @wix thunderbolt registry module...

MAL-2026-17561 Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

Malicious code in abbishal-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...

MAL-2026-17559 Malicious code in hardhat-kex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry...

Malicious code in hardhat-kex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry...

Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

MAL-2026-17534 Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

Malicious code in hardhat-spack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59c971c63de9d0a7f66c26093f528164990af10eca00a3a36b97d0c8b0a6d0d The package is published as hardhat-spack but presents itself internally as a pino-like logger. Its main export is a middleware factory that spawns...

MAL-2026-17560 Malicious code in hardhat-spack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59c971c63de9d0a7f66c26093f528164990af10eca00a3a36b97d0c8b0a6d0d The package is published as hardhat-spack but presents itself internally as a pino-like logger. Its main export is a middleware factory that spawns...

MAL-2026-17537 Malicious code in @angulaar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42861c7641349d2f58380e4f81b13ad9738dd254f224e9f7f239d9cf940cf792 The package's package.json defines a postinstall lifecycle script that fetches a JavaScript file from a non-publisher host gitflic.ru, proxied via...

Malicious code in @angulaar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42861c7641349d2f58380e4f81b13ad9738dd254f224e9f7f239d9cf940cf792 The package's package.json defines a postinstall lifecycle script that fetches a JavaScript file from a non-publisher host gitflic.ru, proxied via...

Malicious code in @anguar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata...

MAL-2026-17535 Malicious code in @anguar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata...

Malicious code in @abgular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c4c8470613dc3a49e249f1a9f91bc756bb9b4323c78268b35816f07e78a0a9b Package name @abgular/core is a single-character transposition of @angular/core and copies that package's description, author, and repository metadat...

MAL-2026-17532 Malicious code in @abgular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c4c8470613dc3a49e249f1a9f91bc756bb9b4323c78268b35816f07e78a0a9b Package name @abgular/core is a single-character transposition of @angular/core and copies that package's description, author, and repository metadat...

Malicious code in @angulr/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24dfd4b0a686b9056ff662e6fee53edfe23c7a94a5edf93fb4cace176216518 The npm package @angulr/core masquerades as Angular's @angular/core by cloning its package.json metadata description 'Angular - the core framework',...

MAL-2026-17538 Malicious code in @angulr/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24dfd4b0a686b9056ff662e6fee53edfe23c7a94a5edf93fb4cace176216518 The npm package @angulr/core masquerades as Angular's @angular/core by cloning its package.json metadata description 'Angular - the core framework',...

Malicious code in @anuglar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98 Package name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description 'Angular - the core...

MAL-2026-17541 Malicious code in @anuglar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98 Package name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description 'Angular - the core...