Malicious code in devplatform-data-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949 On require'devplatform-data-table', index.js loads ext.js inside a swallowed try/catch. ext.js reconstructs a rotating list of Cloudflare Workers...

MAL-2026-12785 Malicious code in devplatform-spa-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a On require, index.js loads support.js, which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev and fallback domain sdk.dl.wel1.ru at...

Malicious code in streak-daykey-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bfd8e4427384eea912513d380b6615e3213b2df455b3dd42e2292467127b307 On module load, index.mjs invokes flushInternalData, which creates /.cache/openlarq, downloads a binary from a base64-obfuscated Backblaze B2 URL...

MAL-2026-12476 Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...

MAL-2026-12438 Malicious code in sme-crm-services-sme-crm-services-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ec89cd09f6d62ee7e1a0e509712ee53f41f3ebba4139453cf1e3a1080fe3c9 On require of the package, index.js loads vendor.js which selects an OS/architecture-specific URL path, downloads an opaque binary over HTTPS from...

Malicious code in statist-browser-typed-client-mb.product.operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cd571b2f151fe07ba9e4be24c62290f79b73880ec1da77324b192a1b3af24f index.js unconditionally requires./bridge on module load. bridge.js selects an OS/arch-specific payload URL from string-array-concatenated hostnames...

MAL-2026-12226 Malicious code in time-webkit-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da59763ac0349051b13656079486ab8c8c08971ff18c5efa84fbf8f5ce022a0 On require of the package, index.js loads init.js which unconditionally invokes start. start selects a platform-specific asset path, assembles CDN...

MAL-2026-12298 Malicious code in twork-data-services-proxy-invest-symbols-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc81e5181d9c63254883ad238b48528c69f67f901daa5876684cc7490de64356 On require of this package, index.js loads init.js which immediately downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...

MAL-2026-12263 Malicious code in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc7dae6b0c575dcb758eec30a647592471c39ded904ff4ed379cadd93b4f6cf4 index.js requires./polyfill on load, which selects a platform-specific endpoint, fetches an opaque binary from runtime-assembled Cloudflare Workers...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574d66d11e91bfbe850944dd5bf0cb0f149ebfe6afe59b0a0be6e88c3fb99d3e Package presents itself as a trivial event bus index.js exports a small EventBus class but its main entry unconditionally requires./ext on load. ext....

Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

Malicious code in colorstack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05f3b08a41e5239924e109a14b8d91b4542bbbdddb1138a1bc6c9cfb7137b053 The package publishes as 'colorstack' with a summary advertising a color/gradient library, but installs under the import name 'newcolors' and exposes...

Malicious code in tinymask-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1d083feee4cace9dba5cabdfd74701c7dc093520f0bbc104858ab699203604 index.js declared as the package main reconstructs a host, URL paths, and dropped filenames from String.fromCharCode numeric arrays, resolving to...

Malicious code in veteran-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2528c02db9bcb4016a3347fdfae55c037c0462d6c0d29adb4245605424ad31f On npm install, the postinstall hook node install.js downloads a platform-specific binary archive from a hardcoded...

MAL-2026-3767 Malicious code in node-ci-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1593e77b5e2763e7ace49c239accedfe30209faea11bc07cf3901a7253798444 On require'node-ci-utils', index.js runs a top-level init that, on Linux, creates a hidden directory /.local/share/.nodecache/, downloads an opaque...

Malicious code in typography-stylecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eeb50f69746fd21696baaa7d3534bbd22489edb037742ca591d49ca88981f70 The package impersonates the legitimate @tailwindcss/typography plugin: README, src/index.js, src/utils.js, and src/styles.js are copied verbatim fro...

MAL-2026-37 Malicious code in aoohttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9d3438b2d065c0535b5ac80ce789201be4f8095642d0f10a20a7da13d46152f8 Obfuscated code downloads an encrypted binary blob, which is malware finally starting cryptomining. After starting the malware, the Python package uninstall...

MAL-2026-36 Malicious code in aiohtto (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9338a4f3f167cf0ba279696ac9ae9bae26219391e2a87a805cc8bb92b4cddd6e Obfuscated code downloads an encrypted binary blob, which is malware finally starting cryptomining. After starting the malware, the Python package uninstall...