MAL-2026-3275 Malicious code in @kills_sh/bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e7f5c26dc70e3f5d44e3fc5b4b94fba66089cf8d0d718fc48c4f85aada6f830 The package @killssh/bootstrap was found to contain malicious code. Source: ghsa-malware...

Malicious code in bytefrontier-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d258ef52db5cbfc634713540fa5f4f797e50b65fa49d3271b9cd3cf34b20dc The package bytefrontier-core was found to contain malicious code. Source: ghsa-malware...

Malicious code in customerdigital-ui-components-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a8c957edf16da956a7859c7a0e1d8accbe84824b88f1f19f70a01acd07b729 The package customerdigital-ui-components-lib was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2110 Malicious code in react-tailwindcss-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5602af4bd6e54460627a64eb9632c4f1ec0e8604d523b76c272346a2f599cb99 The package react-tailwindcss-style was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1492 Malicious code in strapi-plugin-workspace-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360f06861421eccfdc69a5f18ecfe67b3785cb24bb1b0d1e6dd3f5d65df20f20 The package strapi-plugin-workspace-plugin was found to contain malicious code. Source: ghsa-malware...

Malicious code in sinon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0984c139608f25fa3bdb0532d380ee76d21328bb17bb2d72f996112391a4e239 The package sinon-web3-chain was found to contain malicious code. Source: ghsa-malware 19e2ec9a6d3e1d35b0423ee04424704fd978ba989624faa1485f07c6de16b3...

Malicious code in csv-parsing-xz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbd0bb44a5de8aaaa9d2397fe8ff5fa7e9a7274bb5d6efe9ef6af97ba8747692 The package csv-parsing-xz was found to contain malicious code. Source: ghsa-malware 40d41fc1adde6793bd8a6626e41da04bcb68b4934a4760eeb34c278ed6165adf...

MAL-2026-234 Malicious code in xml2js-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18f9df8257f4f610dbfd70460757eb36539314c7cce4d9eda82758da6984725 The package xml2js-js was found to contain malicious code. Source: ghsa-malware cf7cd10255ee6ff91469e7f180436d90c3eca29de3dc0b3f883c13403ca30132 Any...

Malicious code in tailwind-stylecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c71a662da2f505a840efadd0fae8fc82d44fe869c688fc1a5f4b7bf4d0a517 The package tailwind-stylecss was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192551 Malicious code in gfruitmaliciousxmlparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4813943ebd3c7e53be5309757e509dc22587aab81ded149ba9b56b37e87a4dd9 The package gfruitmaliciousxmlparser was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192309 Malicious code in node-dpapi1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a892f37c5be6dceac9cda541ce52d7dc4456d98acbfaa7d2a1e530d181567e29 The package node-dpapi1 was found to contain malicious code. Source: ghsa-malware 96a0f4f04fbe21b39cfa4fe8473fc5394bcecce0f814fcba5f89d6f6217e523d An...

Malicious code in nitro-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ef7661deeec20f2ea8ef1c642811be2a627ee5e8b6a3f51cd61de1e421547b The package nitro-graphql was found to contain malicious code. Source: ghsa-malware a77bf7f130d454574e5e838c6ce7922e015408f32542a4b15e77d26698129fe3...

Malicious code in unitest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aed7fa383be13086f76d33ea8cf0fb7262464155423ce6c74e8f46c1bf69f6fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tmp-npmsnha (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6b7dcde36d84ee5704ed922a7c1b72873a03638a5f31d9e7a57aa2c7c4d2399 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in middleware-loggers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 572eeb4389dd6da0c13648478c40f302f15e7736279e3b33d171a315a2cac60d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47091 Malicious code in tripactions (npm)

The package tripactions was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd811dd81c5402b7511b48c5c95b3f347a050a63cc7c5a0bb9e5cdc47bace8a6 Any computer that has this package installed or running should be considered fully...

Malicious code in vite-meta-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38fbb013e3df2485e72ad722dfab14b0295214d9f631913350b0eec0d658469a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in affirmv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37426adb6b2eb639d44506bcc9b739c4ffb2c7b93c57139aa1757972f6cff5a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in neondatabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73494ce92c6c9b63069dc80526292563ec3c1b787487708dd8a2fb0fe8c6a240 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internal-company-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6546fa1cf98f708a73bf9fbfdaeeef7667dc18db200c8b221c4e61a1507d02a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...