MAL-2026-13613 Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

MAL-2026-13446 Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...

Malicious Package

Overview trapp-check-logs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview svelte-mapped-metrics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview wallet-monitor-snap is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @afasinatickets/common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @whalent/agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tailwindcss-scrollbar-hide is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview golaaa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-13215 Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

MAL-2026-13319 Malicious code in dolyame-boxy-independent-bnpl-items (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b31579fb9a360c4781524c5edd9d0e7b84440e7ccd073e09d54afc10678764cf On require of this package, index.js loads compat.js which unconditionally downloads an OS-specific binary from Cloudflare Workers hosts assembled at...

Malicious code in bnpl-blocks-atom-bnpl-small-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c774d6998dfe3f37ec23c527ddb5dee44c7448c88d5f059905ed3b6ef04959c index.js unconditionally requires helpers.js on module load. helpers.js reconstructs mirror hostnames from split string fragments e.g...

Malicious code in claims-to-iso-string-with-timezone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlle...

MAL-2026-12644 Malicious code in claims-to-iso-string-with-timezone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlle...

Malicious code in devplatform-nx-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf The package presents itself as an Nx stylelint helper but its main entry requires platform.js, which on load downloads a platform-specific executable...

MAL-2026-12498 Malicious code in wagmi-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...

Malicious code in gekko-trading-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efc19985c853a3f4fdc8bdb1f08b432456b8f55ce701567edbf593fb3e6211c The package's postinstall hook runs setup.js, which unconditionally downloads core.exe from the hardcoded Cloudflare Workers subdomain...

MAL-2026-12396 Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

Malicious code in pfp-integration-mobile-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3428631054a61f4fd2a14f372d7c782dd08633446897b0ee0959d259496d170 On require of the package, bootstrap.js selects a platform-specific binary path, downloads an opaque executable over HTTPS from a rotating list of...

MAL-2026-12221 Malicious code in tailwind-custom-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2 The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at...