MAL-2026-17424 Malicious code in kartykgithub-ph-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1a43aa1b797b98f578426b682f248b9e54bfd67acf5fc4030455c7d7228bc92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @firelordzuka/pulse-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8247d4cb8f4973f229f36053baee4350a10058ec5290e6fad9659ebe1c04f8a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in link-status-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38a885003c985463c91366a4a8615fab9c6e4d876afdf33493c3e0463066cbdd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @test1230504/string-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3db7a7676eff4019a9ea78b6c9dd142798bde72fd9ed62fc031b01312c8d3d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @test1230504/test-publish-verify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7ea9c6779e576936608ba007f9f5f3b00a467f2de06dcaa63306ce2cbc676ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in z-deno-truth-ya1t4m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4ca6bf79ee3672fa881c285bd8af8fc4af19fb3be8e90212de7e8a0be70cf30 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16459 Malicious code in webp-https-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 447aba02eddd7913b1520b8d21892e996cecbdf100ba2a772cbff3cb14fa74f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16449 Malicious code in iso-datetime-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9db51cfb135f41debd79f82f4bd905994ecdb54d08811d3755ac66aed13cb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @yane88/hexhub-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a628c35399f2993b111f79396b198c542374b19367ccb6062c5f59f2b61dfdbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14014 Malicious code in try-lock-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 941a65c056bbb40a20dd7b1f4107bf804df157df12ea0b89067fc6770afe3b6b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13800 Malicious code in cvvkshuelwiu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3f325329894b841474989d30370570a7f1b68d02334db1b98dcaf109899fa9 Package [email protected] contains 2 files with no a static rule matches and no traced behaviors of concern. No install-time scripts, network...

Malicious code in csbcldfvivwfgd4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6d7db017a0499c0fca67cc331c44fa736fe52568177990823cb17bd03ceee21 The package contains a single index.html declared as main. The HTML mimics a Cloudflare 'Just a moment...' challenge and contains obfuscator.io-style...

MAL-2026-13677 Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

Malicious code in @zahlen/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...

Malicious code in @keyv/compress-gzip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca4a62f75f4ef4696136cf194317102ad13aa319ba3319fb7dce12de6ae8e9d @keyv/compress-gzip is a gzip compression adapter for the keyv key-value storage library. No static or behavioral indicators of credential access,...

MAL-2026-11505 Malicious code in accounts-loading-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d430e8d55d80c0cf747e6c04058e0bc90274cc943a0e6e15651924c90be46d2 On require of accounts-loading-state, index.js loads setup.js which schedules bootstrap via process.nextTick. bootstrap detects OS and architecture,...

MAL-2026-11451 Malicious code in @spending-behavior-ui/widget-insights (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36bbaed8e8bd830b00f14eaeb532fbeeb0d581a806dbdbca220ab006b1adc958 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...