Malicious code in @ccfly/setup-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec The package ships a 6.3 MB linux/arm64 Go binary at bin/ccfly-setup. The binary embeds github.com/creack/pty PTY spawner and...

Malicious code in @activepieces/piece-google-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e200ba4f9d11d42636dbbd1fa698843321af8b0bd23ff63493c0ce94891a5cb src/index.js imports childprocess and issues POST requests alongside a ping command invocation lines 25, 38, 49. The co-occurrence of childprocess...

Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

MAL-2026-12950 Malicious code in bnpl-blocks-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1d442b520a1779845bf9dc5d8a0cd822606ec46e0a01850143b93e14658cfe9 On require of the package, index.js unconditionally loads setup.js, which downloads an opaque binary from one of four hardcoded .workers.dev endpoint...

Malicious code in bpm-foundation-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers...

Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-12679 Malicious code in delivery-ci-quality (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a7deac8b6933e5d38da84c365f65ac4fbcf7b3a26825914d19ca7aeafcf516 On require of the package, index.js unconditionally loads compat.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers...

Malicious code in sme-foundation-frame-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9bb324a555c0f087f5366e156489724c0b1e06f8b1cdb08032046a0cc1f94d On require/import of the package, index.js unconditionally loads runtime.js, which downloads a platform-specific binary from hardcoded Cloudflare...

Malicious code in twork-data-services-proxy-invest-symbols-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc81e5181d9c63254883ad238b48528c69f67f901daa5876684cc7490de64356 On require of this package, index.js loads init.js which immediately downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...

MAL-2026-12298 Malicious code in twork-data-services-proxy-invest-symbols-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc81e5181d9c63254883ad238b48528c69f67f901daa5876684cc7490de64356 On require of this package, index.js loads init.js which immediately downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...

Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

MAL-2026-6795 Malicious code in zod-pino444 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 560c3d47344d4da5dffac230236b5248d2f1856c221ffac7ff72d4e3b197957b Package [email protected] is a credential/secret harvester disguised behind a benign-sounding name. scripts/postinstall-agent.mjs is a...

Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-4735 Malicious code in xy-ai-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f9025a3fddb0d31a5cd9114850b0ca859acf96e54649d4d2a9fe286b7ca015c xy-ai-chat ships a Lit web component whose bundled main entry hardcodes two plain-HTTP endpoints on a bare IPv4 address:...

Malicious code in xy-ai-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f9025a3fddb0d31a5cd9114850b0ca859acf96e54649d4d2a9fe286b7ca015c xy-ai-chat ships a Lit web component whose bundled main entry hardcodes two plain-HTTP endpoints on a bare IPv4 address:...