MAL-2026-2594 Malicious code in @spoonflower/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e29845a092ba3a019d35adbb88e7fb15512c600cb11fceab06cb845fca75dbd2 The package @spoonflower/ui was found to contain malicious code. Source: ghsa-malware 68f97ac64dba33bf11aa1a9ae810a78f7fb21470e2ccce80e8975cc56d012a7...

Malicious code in @cash-web/no-hardcoded-font-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de4c59cdf3bb5203f5c7721d9180aa09a481a9dd1a6f6aaaf9ca43db40f07287 The package @cash-web/no-hardcoded-font-styles was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2579 Malicious code in @bookiply/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6b31f3177ed87f264b6338a9fe54bb910142b5622bba68372acbac801268d2 The package @bookiply/core was found to contain malicious code. Source: ghsa-malware 2887f360cb9e14cb6c6065ddc86c7aa69674edb8d09486f31b3256f376894e8f...

MAL-2026-2584 Malicious code in @hpcc/js-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66d87d26a2f328414129f2abca4fe30a3f49afcefc1734ff29504b30e8e5e538 The package @hpcc/js-api was found to contain malicious code. Source: ghsa-malware baed13149b187a8ebee8b70891d8c38114a2f8c25e0048e5f2524ae8cb61217e A...

MAL-2026-2608 Malicious code in symphony-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 043c1edf6e1236518709ec4cecd320367fba8de6f3b1ccc52038ada2c08abcb8 The package symphony-core was found to contain malicious code. Source: ghsa-malware 5c6f5ab5486f9ad46cd864ccf677494724eb5cddafcda7be2300f61dc5b2257a...

MAL-2026-2631 Malicious code in babel-plugin-blocks (npm)

Malicious package due to data exfiltration via test, preinstall, and preupdate scripts in package.json using wget to send data to webhook.site. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 679960b444e4781d7276df8692808a4bc4507d29aefe943ffe4d3dfb35dcc141 The...

MAL-2026-2613 Malicious code in upstart-offer-container (npm)

Package collects sensitive data SSH keys, AWS creds, env vars, exfiltrates it to a remote server, and executes shell commands. MALWARE! --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 148e48dd7b06a250063027a17895962000ca784a3fe52b704bea049afc85763a The package...

MAL-2026-2312 Malicious code in tailwindcss-typeface-inter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a4cecee37faea4489bd810f6d044cde9205a74e0c225bef7b07cbbe207eb88 The package tailwindcss-typeface-inter was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2237 Malicious code in jsonify-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16e04dbb8a655525d1dcc95902eacad5b738ac61852151526e1e0a95447a3f0 The package jsonify-builder was found to contain malicious code. Source: ghsa-malware 4f4842e5bf9d324a472ef06cb8dc42b177eee930c375c76176e9a67f032d05f...

Malicious code in validator-lut-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c9f447a3c02a6c7ea716862009fcf6853c8d52e05144fa78746cbdbfe3ef000 The package validator-lut-sdk was found to contain malicious code. Source: ghsa-malware...

Malicious code in tailwind-compile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbf65c7619b6b53280e5b8466ad34ab144b9e6f1da1ab9a80fc621001cc380e The package tailwind-compile was found to contain malicious code. Source: ghsa-malware c6dd40384bf67bcd86f55c070ba74b522d8a9531dec334d4604f0b3737cd96...

MAL-2026-2193 Malicious code in @sixcore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1286e85f8b045ceb430500873b6a172bc5bef2193da8d53ec25183e7a4984cd8 The package @sixcore/baileys was found to contain malicious code. Source: ghsa-malware 4d631c0d901cd4ee9e33f1b24f2a7e067cb4369c7813ce8d46e7e7f0e2217a...

MAL-2026-2190 Malicious code in ts-bign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a068fd0715cfd570ef64c7f6d249383560483880d19fb75a94ac4997a742c70 The package ts-bign was found to contain malicious code. Source: ghsa-malware 6e364f088c15924f92d8290e79ca278120b3d8778345dcad0aad75e821d352e0 Any...

MAL-2026-2189 Malicious code in simple-util-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e97df136a9f8721793e4556b53f908cb10a6df1b2febf5edd3d9d8ef7ab2c7 The package simple-util-kit was found to contain malicious code. Source: ghsa-malware ade2d906419f8d8a97dff43ed8530e27612faa88503c6696838b30f201d5e6c...

Malicious code in @shennmine/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04f4d27219071c7adbcedd56c54f0ca559b3d3651e6203b38d5170bb0e239f66 The package @shennmine/libsignal-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2168 Malicious code in chai-patch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7a1b00f9cf8ff93aebfbb318e0f4da8d56a985a1eca3c305142e708dc6fc55 The package chai-patch was found to contain malicious code. Source: ghsa-malware a5b659f5744d677c50cb63bc98f750071b3db390e25b81a553debdff48ffac6a Any...

Malicious code in @rexxtheproject/elaina-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35f9ef0d26d553f66ecfe3fb2813906a4a457ec3918fb5c0508441f3e13d3fa4 The package @rexxtheproject/elaina-baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2156 Malicious code in tailwind-animationbasis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 613bfa904c0195c7d59209123554b2be83ed4a0568c174e8b221e22725fec103 The package tailwind-animationbasis was found to contain malicious code. Source: ghsa-malware...

Malicious code in puzzle-render-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c63be86e7f93cd0f5f6663aa57978a4c6ff6b497ef1aafcddcdbea71e25fa02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-2103 Malicious code in ty-config-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fdfad9d372aeb95a258e5f5c732b57d1d226d7101ccf09a33cd3eb93ab45d59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...