MAL-2026-11449 Malicious code in @sof-assistant-fe-lib/vertical-faqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d1ba538ee75936802bcb54b49dd258a1941bf7b9f07bc0b05db81fd656c47e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11440 Malicious code in @meli-testing/jest-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a676fda55082dfbd3f6cb792419d9e7156f49a8c587526a37edf9cb09f535d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11442 Malicious code in @mp-op-ss-front-lib/tracks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d870b0214c38734a6a9b3073e958bb198a11243a3093110cc85be0b7ae9bdb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @finance-ui/finance-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b752ae2cd0e6a1f9faf2b0c3376aa390e9708b86705621087e72e95de4333448 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11443 Malicious code in @mplay-core-lib/utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eddb6f3032b394543236ca6a9378654e0d657ae7c80790126b90be036019607 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11436 Malicious code in @finance-ui/finance-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b752ae2cd0e6a1f9faf2b0c3376aa390e9708b86705621087e72e95de4333448 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in metrics-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...

Malicious code in refbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...

Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

MAL-2026-11469 Malicious code in iwomm-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc6a86a4bd25e85d55ccc7babe614b8cf8eb1b31572b67b1f463ad0302263669 lib/report.js imports childprocess, fs, https and os, collects host and user identity data via os.hostname and os.userInfo lib/report.js lines 160-16...

Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ee88b53e786db18609f7956c556a7f814b476c895bb90d5663aedc82ca14f0 Package name 'mcp-server-boilerplate' is unrelated to the Model Context Protocol ecosystem it evokes; the shipped code is a data-collection payload...

MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ee88b53e786db18609f7956c556a7f814b476c895bb90d5663aedc82ca14f0 Package name 'mcp-server-boilerplate' is unrelated to the Model Context Protocol ecosystem it evokes; the shipped code is a data-collection payload...

MAL-2026-11460 Malicious code in create-remotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c0780d44a66914255959e786d3ef18ae49763037a2d714a0a610ef1cc1187 lib/report.js imports childprocess, fs, https, and os and collects host identity and environment data via os.hostname, os.userInfo, execSync..., and...

Malicious code in maximumsats-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6163cb4abd0ceee120100e4ce84e0e12bff00348ee3b55ad338d7d1d3adca47d lib/report.js gathers the developer's email queried via gh api user/emails, git config user.email, /.gitconfig, npm config, and environment variables...

Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...

Malicious code in attio-discover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db27d7cbc4d04670f5b2d1e199294b46fd92375598b362f501010c0cc1eddf9 The package's postinstall hook invokes lib/report.js, which harvests the developer's email queried via gh api user/emails, git config, npm config, an...

MAL-2026-11456 Malicious code in attio-discover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db27d7cbc4d04670f5b2d1e199294b46fd92375598b362f501010c0cc1eddf9 The package's postinstall hook invokes lib/report.js, which harvests the developer's email queried via gh api user/emails, git config, npm config, an...

Malicious code in capacitor-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02650efb5b0f2e8ca581f927c0ca3e50966bc8b425e81a6e2dc9f45c70234422 Package name typosquats the legitimate @capacitor/assets. On postinstall via postinstall.js invoking lib/report.js, the package collects developer...

Malicious code in kip-mcp-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd2c47d8520d4f3bbff232ba1143fdbf7f64f1fa31a70f91be117714d19455e2 lib/report.js imports childprocess, fs, https, and os and, via execSync plus fs.readFileSync calls, gathers host identifiers os.hostname, os.userInfo...