MAL-2026-5200 Malicious code in @ethlete/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 580c72aa7afc42653ec3679eeaa96ac10d9c389434355415542ac48a36c39b45 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

MAL-2026-5230 Malicious code in autotel-subscribers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374da77433b452664266e009188064316b6defdcb0ee4b7e391a158a0a5ca6bf No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle script fetching remote...

MAL-2026-5218 Malicious code in autotel-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1bce8c001a8e85b493ccdd8af1e3e57f3578d1026e6d5d147374b0a68467313 autotel-devtools ships bundled CommonJS and ESM artifacts dist/cli.cjs, dist/cli.js, dist/index.cjs, dist/index.js, dist/server/index.cjs,...

MAL-2026-5240 Malicious code in create-cf-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6567c748c8606e9aa7982b7eb2eb585824d9a1e29b951f50fa9c49007eb28804 No concrete installer-harm signals were observed in this version. The package name suggests a Cloudflare token helper utility, and no exfiltration,...

Malicious code in awaitly-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3015c3afc4f26f62482274726cb1ce34f803abd4b7e84a6eb7e0c802e8c8b7df The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in executable-stories-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 763be018d834c8776be31ab5121b48eaf1172a0b48b933bc6b792484d2ac742a The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in autotel-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 084f88eef116d14d53849eed11b7995a96c7869df33ef39a2af8e84d44dbd750 No concrete installer-harm evidence was identified in this version of autotel-mongoose. The package name resembles the popular mongoose ORM library,...

Malicious code in autotel-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f318ba7cb2f7115530a39f61c409a81a0f2bf94aa552e4a0ac6a0b21570b822 No concrete installer-harm signals were identified for this package version. Coverage of the package contents was partial, so a definitive...

Malicious code in eslint-plugin-awaitly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbd803fb072d271da9c655f60d16fa4e33582d1acb075aa6427449c2a417b72 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in executable-stories-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3137898a0ce7b26bf51153300f929a28c1d653830a2ddf7f57d7dea270e2a7e0 No concrete installer-harm signals were identified in this version. No lifecycle hooks fetching remote payloads, no credential or environment scrapin...

MAL-2026-5261 Malicious code in mountly-tailwind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e398eaa72f57a4536d3bb3c64f27de01f4a1d91cf64c65f10b8949dcfb4cfb91 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

MAL-2026-5242 Malicious code in creditcard.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d465ca657b19d32867e41b0ef3e049313241bba9db41c54c9e73d1682d7c1300 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5256 Malicious code in executable-stories-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3137898a0ce7b26bf51153300f929a28c1d653830a2ddf7f57d7dea270e2a7e0 No concrete installer-harm signals were identified in this version. No lifecycle hooks fetching remote payloads, no credential or environment scrapin...

Malicious code in node-env-resolver-dotenvx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1935de81fae9e35f6c7373f982092558f30d269b205a6edf0d847fb86d0bf3b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in discord-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4aa1d4766f5f0c7701bef21a8e9391a0b851eb0ad75d711143b670f4491bd3e2 No concrete indicators of installer-side harm were observed in this package version. There is no evidence of credential reads, environment scraping,...

Malicious code in autotel-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9746e4768872ec865677aee5e0616ec2bddc7d5d26e9c58bffd5541533612d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in autotel-edge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 811b38cb7e91f18a899293fc6cd657bdc63f07714d5277920cfc21532b5aca08 No concrete installer-harm signals were identified in this package version. No lifecycle hooks, hardcoded exfiltration endpoints, credential-path...

Malicious code in awaitly-libsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b990b0b3ddf0eb2fbfe64fc70090459960085e3268df5cbdd1a86f958f69448e No concrete installer-harm signals were identified in this package version. The package name combines 'awaitly' and 'libsql' a well-known SQLite-fork...

Malicious code in awaitly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3b437ec90b9b48314676b67f08b3ab9a54e1d3b787aa17d668dd0459f2cf68b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5267 Malicious code in wrangler-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d2085fa4916157b99799df085aa11e3d29bdb9a47f5798c85375b1bfdf8bd7e Package name wrangler-deploy is close to Cloudflare's official wrangler CLI, which raises confusion-risk concerns for developers who may install it...