Malware in transaction-info-generate-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in mock-transactions-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd727a8b4413f4809193cfac838d9b42ddae62a685086036a026ba2a4e7419e4 The package presents itself as a mock-transaction data generator but ships a dynamic-code loader. index.js builds the identifiers 'setTimeout',...

MAL-2026-18352 Malicious code in csec-form-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9c21d4483a24c6cb9c8d70bc589a499b7c4bd952b99cc3e2502c276e8ce6c6 The package consists of two files with a pre-release version suffix 0.0.0-stage suggesting a placeholder or staging publication. No install-time...

Malicious code in csec-form-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9c21d4483a24c6cb9c8d70bc589a499b7c4bd952b99cc3e2502c276e8ce6c6 The package consists of two files with a pre-release version suffix 0.0.0-stage suggesting a placeholder or staging publication. No install-time...

Malicious code in ccsec-crypto-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea1ae7dd68e77ee9ae1b007dd87e4ffb8a3627f74d08f8812eca811bf2a351d4 The package consists of 2 files with no install-time execution, no network activity, no credential or filesystem access, and no obfuscated or...

Malicious code in ccsseecc-form-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1957737b5d2ab838803b712aeea38f8b15bbb5ae465dfab85cecd9f49662bb41 Package ccsseecc-form-validator at version 0.0.0-stage contains two files with no detected install-time scripts, no network exfiltration code, no...

Malicious code in ccsec-form-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d63f5a2ae5ff88439a658fdc6a0c8de8fa078a068a1d872be6afcfb5d29fb5b6 Package ccsec-form-validator at version 0.0.0-stage contains two files with no detected malicious behavior. No install-time lifecycle scripts, no...

Malware in @tableau__catalog-messages/database_lower

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in fetch-hash-cache-atomic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fa5c13f5b907c79079d9030292f1a6dac9d2f0ced56c2efe0e1bfd7021acdb4 package.json declares its sole dependency as a direct HTTPS URL https://artifacts.creditslib.com/npm/plugin-client-queue-field rather than a registry...

MAL-2026-18330 Malicious code in @iobandamwer/native-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cce0282c2e8975376db9fdb7a69afc7ed77c0e7649178967496467e09d7ba328 The package self-labels as a 'temporary placeholder stub' in package.json and README but ships active install-time dropper artifacts: a 93-byte...

MAL-2026-18331 Malicious code in birch-css-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22815f068ecaf85065c389553848537859f9e37623285a9e71b3e81ee9e9b685 Package advertises itself as a zero-runtime CSS theme kit and instructs installation as a Tailwind name-overlay npm install -D...

Malicious code in postcss-semantic-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21c91b39929f03c30e501726fc2d1c1fa43f17bf2ed77bda52380e563c1171e0 The package advertises itself as a zero-runtime CSS theming kit but on require/import executes a chain of obfuscated JavaScript modules. lib.mjs...

Malicious code in harlow-css-mixer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 967e3d3d323d36c24348b9530654c33f19bb96bbc21ddeba103dd755a0c07683 The package contains two files and no code paths that read installer secrets, perform install-time or import-time network fetches, execute remote...

Malicious code in css-hnhxwd-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fd2df1dd4f68e1495d31e75e18917e99ee002c60d5e0327d5d84f9e01d52e8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @regex33-hackerone/tb-compat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfbbff5e8cb2f0f8b14d300fed9343e48339c9c4e52579af53f926ced1218922 Package @regex33-hackerone/[email protected] contains two files with no detected malicious behavior. No install-time lifecycle scripts fetching remote...

Malicious code in css-grid-snap-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b283b75dfc6a5bc055d778b3c5855b75f1f80e95639420cabeb24f8440ec42 [email protected] ships a stub index.js that returns a static object and declares no install lifecycle hooks. The tarball additionally include...

MAL-2026-18308 Malicious code in @s4yhiitestpoc/scan-echo-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56326de32baad0d0d893359e14cf73b56e8139d714f3106fde0c24fdb4004091 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18304 Malicious code in @s4yhiitestpoc/r2-echo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95d0e909637faadf9360929eb9b01bfac02f0a4bdf7bff852267657d09c5b459 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @s4yhiitestpoc/scan-dns-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb3c4b0863ee69937b926b58ee5255e26d0ab3737abd640b92956aef1ca03fb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @s4yhiitestpoc/r2-echo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95d0e909637faadf9360929eb9b01bfac02f0a4bdf7bff852267657d09c5b459 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...