Venom

Venom Venom is a C++ library that is meant to give an alternative way to communicate, instead of creating a socket that could be traced back to the process, it creates a new "hidden" there is no window shown detached edge process edge was chosen because it is a browser that is installed on every...

MSC-2026-11647

Malicious Go modules gocommunity.io/orderedbtree and gogets.dev/btreex impersonate B-tree data structure libraries. The code collects host information such as hardware attributes, OS and hostname, and on matching trigger conditions decrypts and runs embedded Go code in a detached process, receivi...

Malicious code in process-lhpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a663308c4051eb4b31faf7fb984989f3e1b3498e505dc05052e2beb5fbf7e6d2 On require/import, index.js auto-invokes initialize, which spawns a detached, stdio-suppressed node loader.js background process. loader.js performs ...

MAL-2026-16178 Malicious code in process-lhpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a663308c4051eb4b31faf7fb984989f3e1b3498e505dc05052e2beb5fbf7e6d2 On require/import, index.js auto-invokes initialize, which spawns a detached, stdio-suppressed node loader.js background process. loader.js performs ...

Malicious code in open-item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...

Malicious code in devplatform-po-transformer (npm)

Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from split-string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in deposits-common (npm)

Source: amazon-inspector a6d03bd134745bb66c8ba26a5ee1ddd2f9417eab449bd8ca7a4c649064cf38f1 index.js requires./support on module load. support.js reconstructs obfuscated hostnames via string split-and-join oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in delivery-ci-quality (npm)

Source: amazon-inspector 82a7deac8b6933e5d38da84c365f65ac4fbcf7b3a26825914d19ca7aeafcf516 On require of the package, index.js unconditionally loads compat.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf102-baf.workers.dev,...

Malicious code in jwt-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b56e3f2d5fab071637ba7688de6c2a9c3d1c1846b6ec939b82eb2c8e9ff03956 The package is published as a trivial JWT logging helper but its main module jwt-logger.js is a heavily obfuscated string-array dropper. On require, ...

MAL-2026-15991 Malicious code in jwt-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b56e3f2d5fab071637ba7688de6c2a9c3d1c1846b6ec939b82eb2c8e9ff03956 The package is published as a trivial JWT logging helper but its main module jwt-logger.js is a heavily obfuscated string-array dropper. On require, ...

MAL-2026-15914 Malicious code in taskforge-9xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40 The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server , fetches bytes from /api/x-handler and pipes them into a...

Malicious code in taskforge-8xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651 The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it ...

Malicious code in tailwind-container-queries (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...

MAL-2026-15903 Malicious code in tailwind-container-queries (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...

Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

MAL-2026-15635 Malicious code in tailwind-modernanimation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an evalatob'...' call at module top level after the plugin...

Malicious code in tailwind-modernanimation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an evalatob'...' call at module top level after the plugin...

Malicious code in vitest-chalk-pro (npm)

Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running lib/utils/smtp-connection/index.js. That child uses axios to GET...

MAL-2026-15563 Malicious code in vitest-chalk-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e [email protected] declares a postinstall hook node lib/utils/index.js that spawns a detached, silenced child process running...