MAL-2026-17433 Malicious code in figma-to-apl (npm)

figma-to-apl is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

MAL-2026-17435 Malicious code in niksinnkatalapp (npm)

niksinnkatalapp is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

Malicious code in live-detection-dashboard (npm)

live-detection-dashboard is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

Malicious code in figma-to-apl (npm)

figma-to-apl is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

Malicious code in niksinnkatalapp (npm)

niksinnkatalapp is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

Malicious code in apl-rive-renderer (npm)

apl-rive-renderer is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

Malicious code in brioche-apl-dev-env (npm)

brioche-apl-dev-env is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, worki...

MAL-2026-17429 Malicious code in ai-workshop-radio-lambda (npm)

ai-workshop-radio-lambda is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

MAL-2026-17428 Malicious code in ai-workshop-radio-app (npm)

ai-workshop-radio-app is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

MAL-2026-17427 Malicious code in ai-workshop-maa15-radio (npm)

ai-workshop-maa15-radio is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

Malicious code in ai-workshop-maa15-radio (npm)

ai-workshop-maa15-radio is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

Malicious code in ai-workshop-radio-lambda (npm)

ai-workshop-radio-lambda is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

MAL-2026-17430 Malicious code in alexa-cybertron-team-code-review-agent (npm)

alexa-cybertron-team-code-review-agent is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the...

Malicious code in ai-workshop-radio-app (npm)

ai-workshop-radio-app is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

Malicious code in alexa-cybertron-team-code-review-agent (npm)

alexa-cybertron-team-code-review-agent is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the...

Malicious code in okra-cloud-cdk (npm)

okra-cloud-cdk is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

MAL-2026-17436 Malicious code in okra-cloud-cdk (npm)

okra-cloud-cdk is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...

@queenanya/invite (>=1.0.0, <=5.0.0), @queenanya/modules (>=5.0.1-0, <=6.1.0) potentially affected by unknown CVE via @queenanya/baileys (9.10.1)

@queenanya/baileys NPM version 9.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on @queenanya/baileys and may be impacted: - @queenanya/invite =1.0.0, =5.0.1-0, =6.1.0 Source cves: unknown CVE Source advisory: SNYK:JS-QUEENANYABAILEYS-20336218...

Malicious code in fca-raihan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 241006adda5ea773d76d48d874c80a4054215ed18f05de3e392cdd86c0379785 package.json for fca-raihan declares a dependency whose key equals the package's own name fca-raihan with source github:raihan9099/fca-raihan. This i...

MAL-2026-17328 Malicious code in fca-raihan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 241006adda5ea773d76d48d874c80a4054215ed18f05de3e392cdd86c0379785 package.json for fca-raihan declares a dependency whose key equals the package's own name fca-raihan with source github:raihan9099/fca-raihan. This i...