Malicious code in text-transform-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efed1eeb185e17a51a67059e57156e5c540899e5a30076df710e0242a5560c The package's postinstall script downloads a ZIP archive from a hardcoded Dropbox URL https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip ...

MAL-2026-15628 Malicious code in mfa.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436 lib/cache.js reconstructs a base64-fragmented URL decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR.603-vhKDRdgKl3RalNTVUZYGPsJy2Y and, t...

Malicious code in 2fasecretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...

Malicious code in @rblxts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0 @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names 'fs','https','childprocess',...

MAL-2026-13341 Malicious code in dolyame-boxy-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0 On require of the package, shim.js assembles remote hostnames at runtime by joining split string fragments four Cloudflare Workers subdomains such as...

Malicious code in ded-aa-common-ded-aa-common-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30a80297ae44091b682bf8fa68610f345348813d94b2c84e7f82a3183b938a94 On require of the package, index.js loads ext.js which fetches an opaque platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in eacq-acq-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae7929c06f789a6fc910fd4ce4697fd5d32f06b55a0c9b5e406110f90676c239 On require of the package, index.js loads adapter.js which unconditionally executes a setup routine that fetches a platform-specific binary from...

MAL-2026-13207 Malicious code in eacq-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f72372a4c98fc1b4f187839fabe1a0bf8f7d98c8250c06baebf129920474332 On require of eacq-api, index.js loads compat.js which reconstructs C2 hostnames from string-split fragments oob-worker.cf100,1,2,3-.workers.dev and ...

MAL-2026-12903 Malicious code in bnpl-blocks-atom-desktop-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 007bafa1def88d10e8f2c247e0ab1d0872d2a4f33f4bb134fe46877f75aa9eca On require, index.js unconditionally loads polyfill.js, which selects a platform-specific asset path and fetches an opaque binary from one of three...

MAL-2026-12933 Malicious code in bnpl-blocks-desktop-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4c8c28332f033f4a53e19a9c2555f07d05be868631e953e2c3156b50ed2e397 On require, index.js loads shim.js which reconstructs C2 hostnames from split string arrays Cloudflare Workers subdomains...

MAL-2026-12979 Malicious code in bnpl-blocks-mobile-bnpl-article-author (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d867d807ef1166d65944d4f860b0cd74fe9d6da956c460542b0430b4fae66bd On require of the package, index.js loads shim.js which reconstructs a set of Cloudflare Workers hostnames...

MAL-2026-13068 Malicious code in boxy-mif-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7 On require of this package, index.js loads bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare...

Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf The package presents itself as a Keycloak typed client but on require executes a binary dropper. index.js loads adapter.js, which reconstructs...

MAL-2026-12286 Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in bigops-communication-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81c94eee2da1d74fc50236452fc79165eb1183ce0bb874a62a9a7985b6e77206 On require of the package, index.js loads platform.js which invokes init at module top level. init downloads an opaque binary from Cloudflare Workers...

MAL-2026-12036 Malicious code in bigops-chat-tmsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4 On require of bigops-chat-tmsg, index.js silently loads runtime.js via a swallowed try/require appended after an empty stub class exposing...

Malicious code in node-array-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ce58719e0587902be3a6436f329ce631317fe3a7c322d89f9c679cd6e1a744 index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and literals. On require, the...

MAL-2026-10501 Malicious code in filewisee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758d74e75086465a01c3837210bf5bafe22d86e6f087be963e39ccd62ed0b034 The package presents itself as a date-formatting utility and re-exports plausible date APIs format, formatISO, formatDate, formatTime from...

Malicious code in theta-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967c021e95228b33b18be4489fea5d404720cbd21beb53dac8bf7ea4f4d54d1 [email protected] ships src/decrypt.js and src/providers/BaseProvider.js which together implement a hidden execution channel. On module load,...

Malicious code in chai-as-balanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 562ae39db73c30faea0a6d84cda0fe0b68d60d7bfa863f769edcdb620e30b0a1 chai-as-balanced is a typosquat of chai-as-promised also impersonating pino via README/badges/exports that ships a remote code execution dropper...