MAL-2026-11387 Malicious code in streak-metrics-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae3b140d6072d259b286e7487a69cd3babe3855ed26add10dbf664e9ac4aecb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11349 Malicious code in pretty-log-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad32145cb24ae2a271cecb6379d30a531be17d84a0d71189d3a4afaec20af015 No malicious behavior was identified in this package version. There is no evidence of credential access, environment scraping, network exfiltration,...

Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

Malicious code in @zannstore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 708c069b088fb74064262b95a516de8d4b3f3128bd6705d98ee7e8dc10e942c8 @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to keyword co-occurrence of...

Malicious code in aone-cloud-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac6b6dc6a9ebc0c474150ee0d6545f6c3fa790ada20f247ac997ec504ce6ffc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11097 Malicious code in @vaultflow/update-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031c8cb2cc9eb21371fdd4a9a9d6949857fd978868e3dfd8f5d126e95a6a5780 index.js is a verbatim copy of the feross/buffer module with a single injected top-level statement var ins = import'@vaultflow/create-flow' that...

Malicious code in stargateproxyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f37695676321e5bdbf3c1ff13f97619eb46b57d7796f66c3b1448633626858 [email protected] declares a preinstall script that runs node index.js, which collects installer host identifiers os.hostname, os.platform,...

Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home...

Malicious code in fazzanime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 078273c8fb515986eb1019d1fbd9f00c675790be7144b7a68680374352f55881 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc009d2d22b9f02aa6b2cce1ac5eadfcb3f3a7d437cc2ba031eb1e6154da2a4 [email protected] shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, backdoor, or self-propagatio...

MAL-2026-11011 Malicious code in encrypt-string-ttak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf72c81030b9346ff3d3dd6f2e5f3395a61d433def25e5e2ea2a7e52a6051999 The package is published as a UniApp 'encryptString' helper but its single shipped module dist/encrypt-string.js is heavily obfuscated obfuscator.io...

Malicious code in @gocortexio/npmgremlinbox-sendmail-8-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 112e0a80917ce922de20557d22ea75375b07d627784966638b99e1d4ad46a355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-malware-credential-harvesting (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3356b51b55d6905b43444e0ce3552d56ad9af93ba2e040b8ba6a3e80da9a86bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10850 Malicious code in @gocortexio/npmgremlinbox-tapr-ohl-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0fbd65fb65b76a2422d3780b7c2c82554753c78740a272f5c064d40fa239437 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10853 Malicious code in @gocortexio/npmgremlinbox-typosquat-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9195f06446d35d2bfefdd565bd2c6f88680cd808d77ff00b4ff0b295cc84110 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10791 Malicious code in @gocortexio/npmgremlinbox-artistic-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a54621aca82e78e4ee4adc57b3925274a0c7bf3b2d11d6d5af655c584de7fa45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10694 Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

Malicious code in crypto-hasher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5162012006c5d2576c6f93540445f10185d44acfb5cef39764f7a2b45c45d205 [email protected] impersonates the hash-wasm library. Its main entrypoint dist/index.umd.js injects code into the WASM Interface update method so...

MAL-2026-10667 Malicious code in true (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e9073206745b049b5e95082a78cf8c0b48f7dc68cdadf1d20be35c0a89aeecb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sauruslord/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c253865ed8326b20645b4eb66bb0e4bd0445d74ca15fb057ac9839a046e59c9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...