MAL-2026-12040 Malicious code in forge-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3784f08ba715b7afbeecfaa10b9c953b4406770c976bd07200977fa2f80b0317 On npm install, the package's preinstall script index.js collects installer-side system data — os.hostname, os.userInfo.username, home directory, DNS...

Malicious code in aedes_clusters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560 The package's package.json declares a preinstall: node index.js hook that fires automatically on npm install. index.js collects host reconnaissance...

MAL-2026-12033 Malicious code in aedes_clusters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560 The package's package.json declares a preinstall: node index.js hook that fires automatically on npm install. index.js collects host reconnaissance...

MAL-2026-11131 Malicious code in basic-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...

MAL-2026-11153 Malicious code in triage_bot_using_sdkv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, home directory, DNS server...

MAL-2026-11137 Malicious code in jobber-app-template-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844a2ac73b588b6c0c7c370dd647685768992ff3e6b5ef492e6fc6dc6be240ce The package's preinstall hook runs index.js which fires automatically on npm install. The script collects host reconnaissance os.hostname,...

MAL-2026-6485 Malicious code in starship-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4e552337fa70064e0a04644ee5a64378809a85b281eda24707bc9a6eba473f [email protected] ships no real functionality. Its package.json declares a preinstall hook "preinstall": "node index.js" that runs automaticall...

Malicious code in starship-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4e552337fa70064e0a04644ee5a64378809a85b281eda24707bc9a6eba473f [email protected] ships no real functionality. Its package.json declares a preinstall hook "preinstall": "node index.js" that runs automaticall...

Malicious code in simplisafe-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 564baff2e47527f159c52c527e1ea2b93d73625f94737f4397cff99311871a18 On npm install, the package's preinstall hook package.json declares "preinstall": "node index.js" executes index.js, which collects the installer's...

Malicious code in dbt-language-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15387169de77b4c18baf8c3f4d27156085bd06d96d0a27879545c3f0358dba8 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js collects installer-side reconnaissance data —...

MAL-2026-6366 Malicious code in backpack-ios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25f0d7ea98cef4ddcac8af3b854c37c1a8a3246a13357af60cb36589454657b5 package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script collects host identifiers...

Malicious code in llm-traces-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0916c8694f396dfa0947df6e3b3d3966839a6e02d4a4f5b84f698787c446bdc On npm install, the package's preinstall lifecycle hook runs node index.js, which collects host identity os.hostname, os.userInfo, homedir, DNS...

MAL-2026-6373 Malicious code in twilio-voice-js-reference-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a57b06daad43c269fe3846083da2fdce277fd1ff3a9399533072f6e894afc2 Package impersonates the Twilio Voice JS SDK namespace and ships a single exfiltration payload. package.json declares "preinstall": "node index.js",...

MAL-2026-6355 Malicious code in ppt-creator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8040bc58597dee52581beb232688c85302554af0af5726abc15c56a21ac69f2c On npm install, package.json's preinstall hook runs index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, dirname...

MAL-2026-6077 Malicious code in ebpf-tracker-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f51f94366660f50b3ffaacedda1e956035ca8a7e5e0cadc33f2aefc20dd8a6a3 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects hostname os.hostname, username...

MAL-2026-5612 Malicious code in gpt-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b9bdc5e04979d5b4f73407bcedaecc9df24dbb03e0bfbc0edefe333023dc50c On npm install, postinstall.js runs unconditionally and collects a wide range of installer-side reconnaissance data: hostname and FQDN, contents of...

MAL-2026-5572 Malicious code in sendgrid-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f1d48bc557c6afa69c74455fe35f34ed0992082dc30fc09d032523d2329f63 Package impersonates the official SendGrid npm packages @sendgrid/ but ships no SDK functionality — index.js exports an empty object. Its sole purpos...

SUSE CVE-2021-22884

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DN...

MAL-2026-4664 Malicious code in search-connector-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24aea8e5a7338c49dc96e3945ed4d695024c2e169f560e6f3426005ca4666ea4 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects host identity hostname, username, homedi...

Malicious code in search-connector-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24aea8e5a7338c49dc96e3945ed4d695024c2e169f560e6f3426005ca4666ea4 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects host identity hostname, username, homedi...