MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb59d96acba76c5d5e2044eae3d7dfeb33bc19f10d75aa04fcf6765ad9b7fde8 Package @public-for-cdao/[email protected] is a dependency-confusion payload targeting an internal @cdao/token scope. package.json declares a postinstal...

Malicious code in @public-for-cdao/abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 102277e30b4f56dba5ebfb6a6a0ba076163907bfd28b2055b7fe6870261071f6 The package installs a postinstall script recon.js that runs automatically on npm install. The script enumerates a hardcoded list of installer...

MAL-2026-10599 Malicious code in @public-for-cdao/abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 102277e30b4f56dba5ebfb6a6a0ba076163907bfd28b2055b7fe6870261071f6 The package installs a postinstall script recon.js that runs automatically on npm install. The script enumerates a hardcoded list of installer...

Malicious code in @public-for-cdao/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1047a119646917a21b103985170a9e993dee0d95a7b6f1f261ddea944b3bf5 The package's postinstall script scripts.postinstall = 'node recon.js' runs automatically on npm install and performs an installer-side credential an...

MAL-2026-10604 Malicious code in @public-for-cdao/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1047a119646917a21b103985170a9e993dee0d95a7b6f1f261ddea944b3bf5 The package's postinstall script scripts.postinstall = 'node recon.js' runs automatically on npm install and performs an installer-side credential an...

Malicious code in @public-for-cdao/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d844c4af5615aa5e7eb8470e79d2e95b841e91a8a23df81bafdb56f656b0111 @public-for-cdao/[email protected] is a high-version public squat of a presumed private @cdao/api scope index.js exports name '@cdao/api'; package...

Malicious code in @public-for-cdao/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28545511de9101d471f9f9184bd6b86c16380ab3f4740f3772e794ce270b6aa5 Package declares a postinstall hook that runs recon.js on npm install. recon.js reads a broad list of secret-bearing environment variables...

MAL-2026-10601 Malicious code in @public-for-cdao/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28545511de9101d471f9f9184bd6b86c16380ab3f4740f3772e794ce270b6aa5 Package declares a postinstall hook that runs recon.js on npm install. recon.js reads a broad list of secret-bearing environment variables...

MAL-2026-10607 Malicious code in chai-as-act (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf85a5e85f183a28cc32ff39ddcc68ef15b698cc62eccfaa89dd1bb80c709f6 The package masquerades as a chai plugin but ships the pino logger source tree plus an additional payload file lib/initializeCaller.js. That file is ...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

MAL-2026-10583 Malicious code in chalkdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619 chalkdev is a near-empty package index.js exports , 11-byte README whose sole runtime behavior is a postinstall hook that runs .init.js on npm instal...

MAL-2026-10588 Malicious code in momenntjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aae445dd0b77bd7409820067097404e4ccb16d658e7911c7c4e659146fdfad4 momenntjs is a typosquat of momentjs whose package.json postinstall hook runs node.init.js. On npm install,.init.js enumerates roughly 60...

MAL-2026-10594 Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

MAL-2026-10590 Malicious code in openaiwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...

Exploit for OS Command Injection in Gnu Bash

CVE-2014-6271 - Shellshock PoC Summary CVSS 10.0. Bash imp...

MAL-2026-10543 Malicious code in skrill-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e517423e768b0086d0579e460801e0b14cb6e6751a810b23bd9f41954d92779 Package impersonates a Paysafe/Skrill payments SDK name 'skrill-payments', class PaysafeClient, spoofed 'github.com/paysafe/skrill-payments' reposito...

MAL-2026-10538 Malicious code in neteller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 167278e6d334ec3629d24f3031e8dd2920ebbbdfd9ea4918cde2fd1d60e41c3c Package name and description impersonate the Paysafe-owned Neteller payment brand, with a fake repository URL 'github.com/paysafe/neteller'. The...

MAL-2026-10544 Malicious code in skrill-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...

Malicious code in motion-pull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e50d15810c044b3b0355460fdeacea42d89944d351e74bcce9fd976f91915ea [email protected] impersonates the pino logger exports module.exports.pino = middleware, uses logger-themed keywords, ships a ./pino require target...

MAL-2026-10518 Malicious code in chai-as-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12dffbf180eff9ea18e21c9fc8c514912e95e40b3439fc43c3e3124b7ed189a3 lib/initializeCaller.js contains a self-executing IIFE that POSTs the entire process.env object to a hardcoded remote endpoint and then executes the...