Malicious code in ai-node-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae845382ff29756db63bf611b9b6bdbd49c44be3bcc8b283512e6590182ac48b ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator string-array rotation, 0x-prefixed identifiers, base64...

MAL-2026-6508 Malicious code in tw-style-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc430da42cdbbb83b681be645a2bbc3f3f2a48e0e19d9d3624b4b3e6f9aa7e92 [email protected] was scanned and produced no findings indicative of supply-chain attack behavior. No install-time lifecycle scripts performing...

MAL-2026-6507 Malicious code in pump-stream-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b661475c354a21044517667315f026469d531e459803f8d4d9586e5cb67f74 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in block-slot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9443517fbcf695478ab489e9a375823ed1a0030cf6a3a4f6262effca4c5406b Pattern matches fired on index.js for the co-occurrence of childprocess require, HTTP GET calls, and env-related keywords within a single file. No...

MAL-2026-6388 Malicious code in rapidsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5b7fbd87a3c4bf6ff1e7b748244b062b46f850a7f7e034bd460c17668fa99c5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6333 Malicious code in mjs-eslint-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e95cb81c6a1238d751c013def46001948b388083e0d91f7baa5077091ae006 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6315 Malicious code in ts-arithmetic-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4712d3f1a81541e2b3143f89974200358301b0a9831c3187875adc1fbe82bfbe [email protected] ships source files that copy the big.js v7.0.1 library verbatim preserving Michael Mclaughlin's copyright banner and the...

MAL-2026-6282 Malicious code in local-ip-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5741cea5f57c51246c2944fda4ecf601f191b482e5c6effa22b640f8701a00e8 index.js imports childprocess and calls execSync with bash and zsh lines 301 and 317. Without further context, it is unclear whether these invocation...

MAL-2026-6288 Malicious code in ts-numbering (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa4527431d4606a2360de6e24717f43f7053fc7d94f2f57ac5278a5676f06b4d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6119 Malicious code in parket-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d62a38af75a45a91e590e0cffe4f58e900fe726b4323af1e481118d146277c index.js imports childprocess and invokes execSync with bash and zsh shells lines 315 and 331. Without traced reachability, it is not established...

MAL-2026-6111 Malicious code in @rafaelsene01/agent-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3855afe87d31e428546f226e1da9236cd0e4dc45a477afb9f6ba1c707a4b05ec The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfuscator declared as a...

MAL-2026-6064 Malicious code in tailwindcss-animates-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7250854be2f2ab8b43e62611a704a3c31d3f42180356e61955b4fc30fd2bcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5996 Malicious code in @mastra/agent-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ba6a41e7e43733a8334968ce740af8771208c66c7529d9f4319bd62e39601d @mastra/[email protected] declares a dependency on 'easy-day-js@^1.11.21' in package.json, but the package's own compiled code in dist/index.js nev...

MAL-2026-6008 Malicious code in @mastra/cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ccfd7b5e8a2175fbbd3659131d6268b8a6dcaa22ff084dce526b93a415b018c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/vectorize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3388ddbcdb1a37e8cb864a2b4b8b7b6a1c7b3dcd00735a6f962f56432a9b0ab The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6025 Malicious code in @mastra/koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0e8ae2c317dbb57c6a85b0bea50cddd76d109cd8ec802bc646df6c514d91bcd The bundled output at dist/index.cjs:212 and dist/index.js:210 contains a Buffer.from..., 'base64'.toString'utf-8' pattern. Base64 decoding into a...

Malicious code in @mastra/express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cd00df32d6d56cd3d4996965ed13e18c1da3a9b0007392b4fc14da1a8fcbb46 The package's bundled distribution files dist/index.cjs and dist/index.js contain a Buffer.from..., 'base64'.toString'utf-8' decode pattern. This...

MAL-2026-5957 Malicious code in @mastra/mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590f8f6b10eff7b7dd626b6e382339b7122f26b43bae2ec5fa02801b0a710638 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5945 Malicious code in @mastra/dynamodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2567710170942391d967675952bbdd9cd0f8d933cc39e4cf4460ca4c5b700097 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/libsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bbbf064d557b14369949349954c599a26dda8f1d99e99bc5528c4b94e99bffb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...