Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

MAL-2026-10594 Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...