MAL-2026-12249 Malicious code in tinkoff-pfp-block-mobile-panels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba61172e292eb3f23c0077e187700932f461fc726674f5497030751138da2d3 On require of the package, helpers.js selects a platform-specific binary path, downloads bytes from one of four hardcoded Cloudflare Workers hosts...

Malicious code in ethereum-input-decorder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94137fcf0aee7d8edb4e15a8bc9be4455fbdf79cb5bf99987b79f0393fdff62c The package name typosquats the legitimate 'ethereum-input-decoder'. Its top-level init.py unconditionally invokes a payload routine on import: it...

MAL-2026-6542 Malicious code in @osmura/treeify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4643c1f27e4916ea6090f1e6196c980fa1d65b96899a80b1f57633eaf16a61a9 The package republishes the upstream treeify library Luke Plaster, repo notatestuser/treeify verbatim under the unrelated @osmura scope, preserving t...