MAL-2026-12215 Malicious code in statist-browser-typed-client-sme.salary.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66329f83c07140aacf28b612ad7211b0279deeef95014e0720b4c7be3097a3fe On require, adapter.js fetches a platform-specific binary payload from split-string-obfuscated Cloudflare Workers hosts...

Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

MAL-2026-12156 Malicious code in bigops-chat-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8d11b7e8abee5caddc5c2f1765fa7f10d40c8cce0ef1cafed55fe31537be94 On require of bigops-chat-transfer, platform.js reconstructs one of three Cloudflare workers.dev hostnames from split string fragments...

MAL-2026-12060 Malicious code in beaver-ui-card-large (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cddf97a67fa28e298f65b3f96b200109d5f15a8a6dde49b8bdd025e8052abf2 Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap on process.nextTick so the paylo...

Malicious code in colorstack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05f3b08a41e5239924e109a14b8d91b4542bbbdddb1138a1bc6c9cfb7137b053 The package publishes as 'colorstack' with a summary advertising a color/gradient library, but installs under the import name 'newcolors' and exposes...

Malicious code in tinymask-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1d083feee4cace9dba5cabdfd74701c7dc093520f0bbc104858ab699203604 index.js declared as the package main reconstructs a host, URL paths, and dropped filenames from String.fromCharCode numeric arrays, resolving to...

Malicious code in binproto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bbe88a299e58c31b71b346733abb6684ce1a1e8e68fad118eca48a53a2b15a3 On any call to the exported pack function, index.js downloads a platform-specific binary from https://wotann-dktl.vercel.app/service/assets/fetchBina...

Malicious code in veteran-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2528c02db9bcb4016a3347fdfae55c037c0462d6c0d29adb4245605424ad31f On npm install, the postinstall hook node install.js downloads a platform-specific binary archive from a hardcoded...

MAL-2026-3767 Malicious code in node-ci-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1593e77b5e2763e7ace49c239accedfe30209faea11bc07cf3901a7253798444 On require'node-ci-utils', index.js runs a top-level init that, on Linux, creates a hidden directory /.local/share/.nodecache/, downloads an opaque...

Malicious code in typography-stylecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eeb50f69746fd21696baaa7d3534bbd22489edb037742ca591d49ca88981f70 The package impersonates the legitimate @tailwindcss/typography plugin: README, src/index.js, src/utils.js, and src/styles.js are copied verbatim fro...

MAL-2026-37 Malicious code in aoohttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9d3438b2d065c0535b5ac80ce789201be4f8095642d0f10a20a7da13d46152f8 Obfuscated code downloads an encrypted binary blob, which is malware finally starting cryptomining. After starting the malware, the Python package uninstall...

MAL-2026-36 Malicious code in aiohtto (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9338a4f3f167cf0ba279696ac9ae9bae26219391e2a87a805cc8bb92b4cddd6e Obfuscated code downloads an encrypted binary blob, which is malware finally starting cryptomining. After starting the malware, the Python package uninstall...