Malicious code in transform-es2015-shorthand-properties (npm)

The package 'transform-es2015-shorthand-properties' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2...

Malicious code in cortana-md-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 686dc6172d061151a94189d41cd564a6127d00f10af75880962a357301ec135e The package cortana-md-bot was found to contain malicious code. Source: ghsa-malware a712b3a56136d272ebf1a688ff9ea1cc572023730622963df1e6e82389177d28...

Malicious code in iron-signals (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 015416030a87f010b10b6babdffd64778563cfccdc5ad2fa610f456be6314658 The package iron-signals was found to contain malicious code. Source: ghsa-malware 2845ee24242fc511c6b3d7ad1fe8ed0ab3feb42f943edae6255d0a72f2b88460 A...

Malicious code in jsonify-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a8aa1030a7553e5aa40c2770df5c5945ccce7110fbe89a5931b7003453aa08d The package jsonify-core was found to contain malicious code. Source: ghsa-malware 15401bad013f01305211dd3ab1307a4ac9383ef3846645fd154ab648ce77e956 A...

MAL-2026-1194 Malicious code in cmc-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7378c3fbef6f6a80690e0834d8bb1b459165cc9b55bc4d2ac2dcc0c1a574983a The package cmc-client was found to contain malicious code. Source: ghsa-malware 5986e6b65452c046e565efac71b9b6ce753244cfb1c7f2d7ce11751a5f827f69 Any...

Malicious code in selfbot-lofy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef24f8180f463b198ff4fea466684c4439a31102aead233f8faa51b587ac0bb9 The package selfbot-lofy was found to contain malicious code. Source: ghsa-malware 1af8492fa4885fa5b969d5ef3947595dffa2f959bb4e1de73b9ca504dec215a8 A...

Malicious code in @powpegtest/powpeg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0acf5c813243b7a0b83c02048de4112604eb9ad97d612f3822206a0cfbf174ad The package @powpegtest/powpeg was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1171 Malicious code in @snazaah/davey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e0f71f42be87797ef9a1316bba8adb9bdef08cc765a42d1b707487f790846af The package @snazaah/davey was found to contain malicious code. Source: ghsa-malware 1e647d7cf3afc1b7a160585b664e75a2515b6b9e00925bdbc30e20625731d490...

MAL-2026-1150 Malicious code in libsignal-yazxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91d9a354d77eada4afacd4c7b884cd9b3c9487007f544b4de3068e3c3348b593 The package libsignal-yazxz was found to contain malicious code. Source: ghsa-malware 04f7491f3c5360ba3b0ea3989fbc6fabe1d113734b5f7824bbe6fe274d830f8...

Malicious code in socket-dgxeon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b1cdce1957669bd7cca7bb7c90b018a87fad6ed9ea49b4874f127272f0c00d The package socket-dgxeon was found to contain malicious code. Source: ghsa-malware 0f36366d3dd38134f3c8176992483c8c67f2e502ca9b774a4ea5a3fc2d428efc...

MAL-2026-1034 Malicious code in chai-lite-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07f2fa37570e8cdb391a3cddfb304c274e9726e3803b150b309816e971577bec The package chai-lite-lib was found to contain malicious code. Source: ghsa-malware c9a6f02ff3187727ac481d692d98a5614c02e6ca28616d6a9d48e7505e63656e...

MAL-2026-1011 Malicious code in node-argon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a249253a8bb08b645efdf877fb82287c002a57b8170e4977ac7344831d08ae83 The package node-argon was found to contain malicious code. Source: ghsa-malware 67f9534d5ccdcd0354d6b224d85adad29d2c686924ced68999d9d4dfd99ccd34 Any...

MAL-2026-882 Malicious code in despicable-me (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a6021ab3cbadc4a7b2c84dee85c1da3a01ecbab1b0a3b1e8aa1f6835a818ca The package despicable-me was found to contain malicious code. Source: ghsa-malware 8919618889f25d842da82fbc9462b9c95cfdcc8aaf393841f00b952d6f2e71f1...

MAL-2026-802 Malicious code in @sbseg-plugin/qbo-web-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8f63d78f9aa713d6b2f068258ae34a81a6c8cfaa91890865506ce11475a44d5 The package @sbseg-plugin/qbo-web-app-ui was found to contain malicious code. Source: ghsa-malware...

Malicious code in tailwindcss-animation-modern (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c6fbd472c63dae399a454decb6c6c097b7ae23766e0962ec081f0ad685ea451 The package tailwindcss-animation-modern was found to contain malicious code. Source: ghsa-malware...

Malicious code in web3-chain-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8092971594fb2e6c9a5748ec492ca88c9a8cc396917b314f09e5c3c85e0d130 The package web3-chain-sync was found to contain malicious code. Source: ghsa-malware a73489541e1d91e9e98d8ee52b10cc423ddd5b990bee23731cfa78e9bce3be0...

MAL-2026-743 Malicious code in internationalized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bb89ff076b952ec364a4b84d4b37a0f83632bea82a2a63b9153d6af9a6145ad The package internationalized was found to contain malicious code. Source: ghsa-malware...

Malicious code in si-wsl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f69e85a7d134f9914d7c06214a1e54622c4cd2548036f89a7de197a219cb598a The package si-wsl was found to contain malicious code. Source: ghsa-malware 883fa40693e776d8efd0a25d3d0cb70348f12f2226eaf627c28c490b46790973 Any...

MAL-2026-674 Malicious code in freedom-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4512163cbee4473b3f1fec8504df8a156ada7ac4ca90a763fb9968ba58178ade The package freedom-baileys was found to contain malicious code. Source: ghsa-malware 7c21d9105c9c9c7f67546b69fd620327c3b304280b1113d557601d49a0639cd...

Malicious code in yazxzpedia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f94694d3882914e6f75cc35db5533b7d7c4d9caebb2631033de332d3c49e562 The package yazxzpedia was found to contain malicious code. Source: ghsa-malware e97d515edc36ba99b0d5fa4cc5cd35798ff96229f05a9f93ba6dbef0631f1ac0 Any...