MAL-2026-17501 Malicious code in a11y-tabindex-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045 a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands cat /etc/hosts,...

MAL-2026-17479 Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

Malicious code in @sarex-team/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7 @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install via package.json scripts.install = node index.js and on...

MAL-2026-14206 Malicious code in @sarex-team/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7 @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install via package.json scripts.install = node index.js and on...

MAL-2026-13900 Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

Malicious code in sc-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09 [email protected] declares a preinstall script that executes callback.js on npm install. The script collects host identity os.hostname,...

MAL-2026-12669 Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...

MAL-2026-12334 Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

MAL-2026-12317 Malicious code in @cryptosrvc/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host...

MAL-2026-12206 Malicious code in simple-date-formatter-util-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28db20339e88b1f37da250a38c838eae62b32419a4c36e806b7c6367671f064c package.json declares a postinstall lifecycle script that runs curl against the hardcoded bare-IP endpoint http://124.221.154.135/pre, passing the...

Malicious code in simple-date-formatter-util-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28db20339e88b1f37da250a38c838eae62b32419a4c36e806b7c6367671f064c package.json declares a postinstall lifecycle script that runs curl against the hardcoded bare-IP endpoint http://124.221.154.135/pre, passing the...

MAL-2026-11134 Malicious code in color-convert-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9 The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity hostname, whoami, id, sudo -...

Malicious code in basic-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...

MAL-2026-11131 Malicious code in basic-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...

MAL-2026-10712 Malicious code in @hibachi-xyz/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5 On require, index.js enumerates process.env and filters keys matching credential-shaped patterns KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, CIRCLE,...

Malicious code in library-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...

Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

MAL-2026-10078 Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

Malicious code in pipo-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 259159c0505b819905dcaf53172d98a4fd590a9ae1a40f87d2be4c1a7fdc4065 This package is a dependency-confusion payload published at an abnormally high version 9999.0.0 targeting an internal package name pipo-sdk. The...