MAL-2026-10439 Malicious code in react-hot-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051 index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named svgValidateKey and svgValidatePattern. When any...

MAL-2026-10185 Malicious code in authvaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c707d53e30a333f8b8cf03ac2480eee3e2fa9c3c3164b1a100d333c91f9f3a On require of authvaultx main: auth.js, which loads lib/writer.js, top-level code attempts to load the separately published npm package...

MAL-2026-2161 Malicious code in path-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83954c990d9e7dddb109dea7f9ed24bc8ded6b95da0ed050b43e7486675fc67c The package path-external was found to contain malicious code. Source: ghsa-malware 28650e14b5d9d8ba8bb4df91ca765c3e40d62074928911571fbdbc9af91c4e2d...

EUVD-2025-102543

Malicious code in rifqi-tahu17-riris npm...

MAL-2025-6722 Malicious code in external-pkg (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in discord-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3cacf31ff8dd68ea83d6884c6f30987d88b3ab1400b897492caf7387f080d2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...