Malicious code in @across-toolkit/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7f4d3a8ae39148bf9964aef6bfe64bc57393c27a28d8e953b30c92442c4b33 @across-toolkit/[email protected] runs a postinstall.js script on npm install that harvests installer-side secrets and posts them to a hardcoded...

MAL-2026-10715 Malicious code in @hibachi-xyz/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 214e1b690352ce0af70ce6a37d3b7ac4d8dec4269dc7606b7a65fbb6d4406e8b The package presents itself as 'Type definitions' for the @hibachi-xyz scope at version 99.0.0, but index.js exports an empty object and its only...

MAL-2026-10716 Malicious code in @hibachi-xyz/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308aa7f8a3746a346bbed305975f68d110bcf6b98815b7bf9f579e37089fd78b The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.js, executed on require,...

MAL-2026-10762 Malicious code in @edgecommons/edgecommons (npm)

The @edgecommons/edgecommons package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name uses an '@edgecommons' scope that mimics the internal/private package naming convention of a...

Malicious code in syft-acp-atoms (npm)

The syft-acp-atoms package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in @edgecommons/streamlog-node (npm)

The @edgecommons/streamlog-node package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name uses an '@edgecommons' scope that mimics the internal/private package naming convention of a...

Malicious code in syft-acp-core (npm)

The syft-acp-core package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in @edgecommons/edgecommons (npm)

The @edgecommons/edgecommons package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name uses an '@edgecommons' scope that mimics the internal/private package naming convention of a...

Malicious code in syft-acp-uikit (npm)

The syft-acp-uikit package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10765 Malicious code in syft-acp-core (npm)

The syft-acp-core package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10764 Malicious code in syft-acp-atoms (npm)

The syft-acp-atoms package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10766 Malicious code in syft-acp-uikit (npm)

The syft-acp-uikit package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10763 Malicious code in @edgecommons/streamlog-node (npm)

The @edgecommons/streamlog-node package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name uses an '@edgecommons' scope that mimics the internal/private package naming convention of a...

MAL-2026-10625 Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

MAL-2026-10602 Malicious code in @public-for-cdao/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a893631e8d2b076ee2c69cfd1126c435c70c02ecb912ef1e6ae383d7f34d78d The package ships a postinstall script recon.js that runs at npm install time. It collects host identifiers hostname, platform, arch, username, cwd,...

Malicious code in @public-for-cdao/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb59d96acba76c5d5e2044eae3d7dfeb33bc19f10d75aa04fcf6765ad9b7fde8 Package @public-for-cdao/[email protected] is a dependency-confusion payload targeting an internal @cdao/token scope. package.json declares a postinstal...

MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb59d96acba76c5d5e2044eae3d7dfeb33bc19f10d75aa04fcf6765ad9b7fde8 Package @public-for-cdao/[email protected] is a dependency-confusion payload targeting an internal @cdao/token scope. package.json declares a postinstal...

MAL-2026-10599 Malicious code in @public-for-cdao/abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 102277e30b4f56dba5ebfb6a6a0ba076163907bfd28b2055b7fe6870261071f6 The package installs a postinstall script recon.js that runs automatically on npm install. The script enumerates a hardcoded list of installer...

Malicious code in @public-for-cdao/abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 102277e30b4f56dba5ebfb6a6a0ba076163907bfd28b2055b7fe6870261071f6 The package installs a postinstall script recon.js that runs automatically on npm install. The script enumerates a hardcoded list of installer...

Malicious code in @public-for-cdao/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1047a119646917a21b103985170a9e993dee0d95a7b6f1f261ddea944b3bf5 The package's postinstall script scripts.postinstall = 'node recon.js' runs automatically on npm install and performs an installer-side credential an...