MAL-2026-10093 Malicious code in @andrewstory18/is-real-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a6faaf0fbf39ed9ec8797c97cb8b2486be8b84eb46bfeabc3412a3eeded4aa1 @andrewstory18/is-real-odd impersonates the widely-used is-odd package by copying its README, author, and repository metadata verbatim, but ships an...

MAL-2025-155149 Malicious code in fitra-poke55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f95e71eac89bcf98b21f9b810893adc107960310f579738930967974dc3a2397 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...