Malicious code in @keyv/serialize-msgpackr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43046321629b6cdd57488aa3c6cc4d826a41f11330ae467c7f7e8c5ed9e8dbc0 Package presents as a serialization adapter for keyv using msgpackr. No static or behavioral indicators of exfiltration, install-time remote code...

MAL-2026-11488 Malicious code in test-dev-boot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd45eccde1d78006f2a808730aa4723756d255697ac1479d52aa7e89f792e51 On require/import and when invoked as a bin, the package's main entrypoint detects Windows and installs an...

MAL-2026-11448 Malicious code in @peptide-packets/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0bc181dc4391ee3b974bfa8ec4aafcf982c6bae5f7d9e6850d03d25293cca6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11300 Malicious code in ethersss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49d76a2dab802ae6aee4310b7efc5a0862c1964a024e7df701cd99741a033797 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11295 Malicious code in ethe.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab166dc6e7cba65e133a48f30493d785512b96592dd9e86b960621ec2125cfcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11335 Malicious code in n158 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3177c7ef8773e8e083ea3062e186487c6ce4f6c0d3919987e2ee4a3df4b1363 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11373 Malicious code in rph-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dcb5532513af2a6e42d28be7ddfccc99a57b576460f797761b64d6ce5cf90ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11283 Malicious code in dsilva-react-module-seed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e6a8391609d3660eb97edc5c301beb1c8d644032e8387a33513121c2bcf70da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in puppetewebr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d670fc86263b8efa05d6e9daa48045f49f3b244f0c7cd3af2c3bf9ba84c01dd9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11308 Malicious code in express.jd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e19d28887abf013d2b9c10ea85d7ca19baeb30f52bd9de4589cd66e687975adc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11263 Malicious code in clotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26eeebdadc62206cf23d190ed10b2f46de8d8af2ac45d9e94aecca3b2c32b048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in unified-help-center-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a76f48c6cd4bfeda98c49e3c091e319501f5566227f6ad6cdb654c193fbe7582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11319 Malicious code in impv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08ab943364555bc64aaa5949d20cb3976e5a47af1429a885373b91cf17c3f4c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thedata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...

Malicious code in logform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec6c47e9e94b571242404a22ce01e255dc1df012c3d13477b5d2db9a96a037c Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README advertises formatting...

Malicious code in postcss-motion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4534713b2409f1fe5588befb885030edc2eafddf215d1103e70f9024c64cbc35 Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its main index.js is a 164 KB single-file...

MAL-2026-11077 Malicious code in @sqlite-tag/sql-creator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a88585293f864e712b64feb436171caab5fc4d9c5d9d3509b2a0a67e04b6e8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11023 Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58, and index.cjs re-exports...

MAL-2026-10666 Malicious code in crypto-hasher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5162012006c5d2576c6f93540445f10185d44acfb5cef39764f7a2b45c45d205 [email protected] impersonates the hash-wasm library. Its main entrypoint dist/index.umd.js injects code into the WASM Interface update method so...

Malicious code in @hkyyy/portal-widget-helper-0601 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72e27d8bfbf5b9bfefe661d642be934399a38031c1bee028a20ed3282e0f482 The package has no real functionality — index.js only exports ok: true — and its sole effect is to run a postinstall reconnaissance script...