MAL-2026-11263 Malicious code in clotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26eeebdadc62206cf23d190ed10b2f46de8d8af2ac45d9e94aecca3b2c32b048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11211 Malicious code in @ethers-sdk/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38a8c103dc06261576987809af8a1deb696dfdabd93bf4116f42ee199ee77cc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ethers-sdk/ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e6d5bcfe574a6eecbff6a32c084a7abd43660939adafa83c7097a96d1ca791f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in unified-help-center-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a76f48c6cd4bfeda98c49e3c091e319501f5566227f6ad6cdb654c193fbe7582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11350 Malicious code in pulleeelll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6b3173a308b5738e4e3047a8125b432486042563101678e0182e95962b37f20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11326 Malicious code in live-reload-on-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7d87f94e77b603423e5ebb9e62f37541ad355708d900e33e0442210ce70957 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in confetti-rebuilds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f2069e994966cd4c815277183b96ea19c7874fbced968edb527a4ba7a2d0697 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in d3-bbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f44d2af489d00e9c5d4afb273874098491e2b6dcf362489ca10229f337a21005 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11319 Malicious code in impv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08ab943364555bc64aaa5949d20cb3976e5a47af1429a885373b91cf17c3f4c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11386 Malicious code in srgb-linear (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 161f0f8d0598a57e1dde7ecb119f308f82a1bad8189fe8dce4bb88547559f588 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pullingpackageeeeeeeeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f91dfa4ff998df4408f931ab845cd0e8ee28ea87257ee5e16a9193be3182e851 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thedata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...

Malicious code in logform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec6c47e9e94b571242404a22ce01e255dc1df012c3d13477b5d2db9a96a037c Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README advertises formatting...

MAL-2026-11183 Malicious code in def-open-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2ab83557d19fac6db95041a0557305c6950f0c181a3998767dfaf011fc02c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11186 Malicious code in lwp-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f48a24eac1771fb54fd93711a3e41754360ae043cecf84fcff3c3d1bb30d297e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @joyfill/layouts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2f0675d4a2717361ec79b2c5a5cbf0ff0367e8d9cbf991f2f300df6c6b819ec Analysis of @joyfill/[email protected] surfaced no a static rule matches and no traced code paths indicating exfiltration, install-time remot...

Malicious code in postcss-motion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4534713b2409f1fe5588befb885030edc2eafddf215d1103e70f9024c64cbc35 Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its main index.js is a 164 KB single-file...

Malicious code in aone-kit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4197cd1713e045c09d745c2d3b518df40d695112f76831bd0e921031cac69606 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11167 Malicious code in local-config-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa2dd509a9d17ced72d7119cf68768f7356d3f67af131e9cbe5bfe981a626ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11101 Malicious code in motion-forge-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...