MAL-2026-10641 Malicious code in polygon-toolkit-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f56f0404b5e3f35ed475dae417f9351d4d149e163598eb72380fb6c025099e12 The package presents itself as a web3/polygon validator but its exported API silently relays caller-supplied data and generated cryptographic materia...

Malicious code in lusha-iam-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46142505b88a255674663ced6e8bce8c8f3e28c0936e463e07463a7e1331e5af package.json declares the node-fetch dependency pinned to a tarball URL on registry.ctzbg.com, a host unrelated to the npm registry and unrelated to...

Malicious code in chai-await-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js...

MAL-2026-6994 Malicious code in chai-presentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d078bac337fe2c1b76c757c29d286fc750be585db65f30f5d696038c2ea0d3a On require, index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's cookie field to new Function'require',...,...