MAL-2026-17657 Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

MAL-2026-17305 Malicious code in esm-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke...

Malicious code in jwtmethod (npm)

Source: amazon-inspector 3dbd06d83019ce10a1c0da788fc10633f55f9f6c82058ca6841c4650b5611afb On module load, jwtmethod's decode.js executes a top-level routine that performs an HTTPS GET to https://jsonkeeper.com/b/E69V3 and passes the response body to new Function.constructor'require', errCode, the...

Malicious code in react-jsonwebtoken (npm)

Source: amazon-inspector 2b46ca6ae72ce6f079c34ec6d1d1d2be46b36fe429374393f0fe57539fe56ee3 Package name mimics the widely-used 'jsonwebtoken' library and falsely declares 'auth0' as author, while the repository URL points to the unrelated 'github.com/radix-ui/primitives'. On require, decode.js...