MAL-2026-13920 Malicious code in bb-twl-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...

Malicious code in bb-twl-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...

Malicious code in @innocarpe/deepseek-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecff1188eb08eef1faffb2e898fe393c3311abdf5e96f041435a5ca12163dc67 The npm package's postinstall script scripts/postinstall.js requires childprocess and issues POST requests carrying environment and host identifier...

MAL-2026-13420 Malicious code in @innocarpe/deepseek-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecff1188eb08eef1faffb2e898fe393c3311abdf5e96f041435a5ca12163dc67 The npm package's postinstall script scripts/postinstall.js requires childprocess and issues POST requests carrying environment and host identifier...

Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...