Malicious code in tailwind-form-kit (npm)

Source: amazon-inspector cccb2aed2f968e146b433d2a2600f17104f0dcacfd951190771f8e59aee3a252 [email protected] impersonates @tailwindcss/forms package.json sets repository to https://github.com/tailwindlabs/tailwindcss-forms but src/index.js is a heavily obfuscated single-line loader...

MAL-2026-16139 Malicious code in tailwind-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...

MAL-2026-16052 Malicious code in open-item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...

Malicious code in devplatform-cli-contracts (npm)

Source: amazon-inspector 6bc9fcdf16d7e6c67e3dbc20a6e8bdec551687bc20fffa3c434a35ca387ffade On require of the package, index.js loads compat.js which reconstructs destination hostnames from split string arrays e.g. "oob-worker.cf100-416.worker","s.","dev".join"" and DNS-TXT fallbacks assembled from...