Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

MAL-2026-13148 Malicious code in dolyame-ui-confirmation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba60f94522cc371a13cce00e6a8e51678812f3f50f3e577fd5e9275295a72e0 [email protected] ships a shim.js that is required from index.js at module load. On import, shim.js detects the host OS/architecture,...

MAL-2026-12854 Malicious code in bigops-videocalls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b04bc16010479f488969366f0af5596c33f668da075e09d5d1b8fad737f03cd On require of the package's main entry, support.js executes at import time: it selects a platform-specific path, fetches an opaque native binary from...

MAL-2026-12894 Malicious code in bnpl-blocks-atom-bnpl-small-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c774d6998dfe3f37ec23c527ddb5dee44c7448c88d5f059905ed3b6ef04959c index.js unconditionally requires helpers.js on module load. helpers.js reconstructs mirror hostnames from split string fragments e.g...

Malicious code in bnpl-blocks-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...

Malicious code in ttal2ttml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29387ac35a2248ad2e4b287b8c082f8d1a8d03b4937fc84a5b81fb85697e19d4 package.json declares a preinstall lifecycle script that runs node -e "tryrequire'childprocess'.execSync'curl -sf...

MAL-2026-4458 Malicious code in @toni77777/aora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8566221a9ab9a1cb01b0f23e2af4b140d2e97310701b8c9a8f4bed1481fb22b2 On npm install, scripts/postinstall.js fetches a platform-specific executable from https://github.com/yourusername/aora/releases/download/v0.1.0/,...

MAL-2026-4201 Malicious code in obs-migrate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ecb04d891693e925c9055e0b5c5844ebb6cf8c210000e9905bf892ab7d0674d7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in cicd-ppe-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c9f1bfe5b5514b9b3a1ffad43be1f06d22faf12f031d325a9e689340c2ab16a0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191809 Malicious code in packed-w3shi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3d670904891ef361ef283e3f218f21b6e3758847277e8bccb0dbecd08b08971a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...