MAL-2026-6340 Malicious code in rainbownkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970be1fb6306ff1e8dc6119d96404f600a1eb44a47124e2910bb9237bb80fe9a Package 'rainbownkit' is a single-character typosquat of the popular Web3 library 'rainbowkit'. The shipped source, README, repository URL, and autho...

MAL-2026-6345 Malicious code in thurdweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7 Package name thurdweb is a one-character substitution of the popular web3 SDK thirdweb, but the shipped source is a copy of MikeMcl/big.js...

Malicious code in thirdwebjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3 Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library with an injected loader...

Malicious code in ts-escrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9607025df61aa1728bceb1a71534460a9e9edf2f3cd1d4eedd533238786577c2 [email protected] is a verbatim copy of the big.js library README, repository URL, author, version banner, and description all impersonate MikeMcl/big....

MAL-2026-6320 Malicious code in ts-escrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9607025df61aa1728bceb1a71534460a9e9edf2f3cd1d4eedd533238786577c2 [email protected] is a verbatim copy of the big.js library README, repository URL, author, version banner, and description all impersonate MikeMcl/big....

Malicious code in ts-escro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26030cb7301c4ff9ea68753581f70290a957e1422b425df7119416fea126c324 The package ships a verbatim copy of MikeMcl/big.js v7.0.1 same banner, MIT copyright, and API but is published under a different name ts-escro. At...

MAL-2026-6319 Malicious code in ts-escro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26030cb7301c4ff9ea68753581f70290a957e1422b425df7119416fea126c324 The package ships a verbatim copy of MikeMcl/big.js v7.0.1 same banner, MIT copyright, and API but is published under a different name ts-escro. At...

MAL-2026-6316 Malicious code in ts-biginteger-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8059a1d2db2edb7231b017023f82f6a651585c0ee7120aaebe882cb6407b9e3 Package is published as 'ts-biginteger-lib' but its metadata, README, and source are a wholesale copy of big.js by MikeMcl author set to 'Michael...

Malicious code in web3-eth-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2e70ad91037bdc97e6b1ab8c95f5f2b5eecdb4524582d79dae5f240cbdbfc29 Package name and metadata impersonate the legitimate @ethereumjs/util / ethereumjs-util packages: README is copied verbatim from the upstream...

MAL-2026-6325 Malicious code in web3-eth-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2e70ad91037bdc97e6b1ab8c95f5f2b5eecdb4524582d79dae5f240cbdbfc29 Package name and metadata impersonate the legitimate @ethereumjs/util / ethereumjs-util packages: README is copied verbatim from the upstream...

Malicious code in web3-eth-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a262e70316cd74a87b043cd1985e456639781763d4a3ef69aa09d99a2795154 Package name, README, repository URL, contributors, and module structure are copied from the legitimate '@ethereumjs/util' / 'ethereumjs-util' packag...

MAL-2026-6323 Malicious code in ts-sudo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a6e18b2d6bef04dd8377fac8d9b20e5545f1ec39875fdd308adf118b6f319d1 The package publishes under the name ts-sudo but ships a verbatim copy of the big.js v7.0.1 source big.js, big.mjs along with big.js's description,...

Malicious code in @outmarket/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd90f0d706cda01a5740f120f6e8d22ae57d907a5000854439c201b3c53a8c0 package.json declares a postinstall lifecycle script that fires automatically on npm install. The inline node -e payload uses hex-encoded property...

MAL-2026-6292 Malicious code in @outmarket/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd90f0d706cda01a5740f120f6e8d22ae57d907a5000854439c201b3c53a8c0 package.json declares a postinstall lifecycle script that fires automatically on npm install. The inline node -e payload uses hex-encoded property...

MAL-2026-6291 Malicious code in @outmarket/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e package.json declares a postinstall script that runs automatically on npm install and performs require'https'.get... to a Burp Collaborator subdomain...

MAL-2026-6298 Malicious code in ttal2ttml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29387ac35a2248ad2e4b287b8c082f8d1a8d03b4937fc84a5b81fb85697e19d4 package.json declares a preinstall lifecycle script that runs node -e "tryrequire'childprocess'.execSync'curl -sf...

Malicious code in ttal2ttml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29387ac35a2248ad2e4b287b8c082f8d1a8d03b4937fc84a5b81fb85697e19d4 package.json declares a preinstall lifecycle script that runs node -e "tryrequire'childprocess'.execSync'curl -sf...

MAL-2026-6295 Malicious code in kdrive-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e7d5af5ddf22d4481fca4847a45189e6160a723341b32dcbb6bf51b49f53943 package.json declares a preinstall lifecycle script that auto-executes on npm install and runs wget -q -O-...

MAL-2026-6297 Malicious code in tree-sitter-forth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f52e13ffb66b20f7c3dca7022e8115dbce1f39264638d38b73d6488e4cbf27 Package is a dependency-confusion lure: it claims version 9999.99.99 with description 'npm 404 error referenced in AlexanderBrevig/tree-sitter-forth'...

PYSEC-0000-CVE-2026-54232

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index flashinfer.ai/whl/ using --extra-index-url, but the...