MAL-2026-6476 Malicious code in typedecode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 593662d3b4cda901642b713f419417807a33f3dca74e818f66e8d0cf9ebcf6e3 On require'typedecode' / import 'typedecode', the bundled dist/index.cjs and dist/index.js execute an obfuscated import-time payload. A bootstrap.js...

Malicious code in clx-cookie-signature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e0e91601d276764067b1b209efd17a1f59ef03ff4fc814bcb22c495f4a0f9b3 Package impersonates the popular cookie-signature library copying its README, author field 'TJ Holowaychuk ', and sign/unsign API, but index.js adds ...

MAL-2026-5788 Malicious code in @solana-labs/web3js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9bcfcd3a9b7eb540a36cb0d90a75c1e0c94cb5e78e265a85539608e3503a214 Package name @solana-labs/web3js closely resembles the well-known @solana/web3.js library different scope, missing dot in module name. The bundled...