Malicious code in fs-extra-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397f5c6f4eb2cf734d5ee1afc9908bdd0162a91a2fc6ad6d7d51a5cfd22fdc41 Package impersonates fs-extra by copying its description, homepage github.com/jprichardson/node-fs-extra, and repository metadata verbatim. Its...

MAL-2026-11029 Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...

MAL-2026-11022 Malicious code in aio-commerce-lib-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9479591a21dd21e28dbd04aaf239e1da57eae40a248247d8e270d8e6f1278fdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58, and index.cjs re-exports...

MAL-2026-10982 Malicious code in streak-daycount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f787426dd4d04d5cd527bdb19d309c64de82e252af4af0714dc33b07a26b73b0 [email protected] ships an index.mjs whose top-level async IIFE runs on import. When the host is Linux and NODEENV is not 'production', the code...

Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...

MAL-2026-10928 Malicious code in upjsma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6da6be7241858aacc6bf0fdef363fad9469efcbd9414b7b6e3e4153eba341f7b The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a fullscreen iframe, and...

Malicious code in iot-kfh-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...

Malicious code in lwc-slds-lbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...

Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

A solo Russian-speaking threat actor known as "bandcampro " outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence AI and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026,...

MAL-2026-10861 Malicious code in @gocortexio/npmgremlinbox-unlicense (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23bb2676a768ebd0e40b34368cca60d48ba7bec21c362d307e1ff87d04b3ba44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10841 Malicious code in @gocortexio/npmgremlinbox-ncgl-uk-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00382b16f7bcacbf6333acca5a11b4f1be3a615a64431e0781cf8d9c3877b813 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in telemetry-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f21f282e7349c68d7ff17d0b5c452fb51c3bab106ffb6f56dc80f108c4b0800 The package's Control.plugin entry point calls PluginOptions, which fetches a binary payload from...

Malicious code in ai-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant const GEMINIKEY =...

MAL-2026-10695 Malicious code in ai-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant const GEMINIKEY =...

MAL-2026-10674 Malicious code in jscrambler-metro-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6330e46f350d87abb62ebe25db40ffb14d8736a91e6b95f77f8cc6df053fbdc5 [email protected] is a Metro bundler plugin published under the Jscrambler vendor namespace. No a static rule matches and no traced...

MAL-2026-10564 Malicious code in micro-ui-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be44655a47177f3740201ddb9dc66db080b9f665354c78bcebeb9a2da3b11b7f On npm install, the package's postinstall script postinstall.js reads os.hostname and sends it as a query parameter in a plain-HTTP GET to a hardcode...

Malicious code in tipsen-last (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8dda277dd82e1c50906cff18341bb76485eed33ba42d39b228c447514e4081f package.json declares its only runtime dependency "safe-chain-test" as a direct tarball URL on hoped-twice-evaluation-site.trycloudflare.com — an...

MAL-2026-10282 Malicious code in acidic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ef3583eb4d5b190d763cd784f5a40cb2cddaa8f1b6cd81b8a663bb612b51bb7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in abuden229 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 348ad89821b1ea36a325bc8f2e570b3a74e3a6238381106746bc31146c743fec The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...