MAL-2026-17290 Malicious code in @rutxploit-sec/waves-button-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...

Malicious code in bnppf-flag-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78 The package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on npm install...