MAL-2026-12118 Malicious code in @zzzgenesis00/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 742be73b4f635f669a2c8191ddc90c46150e9d92ca432e5045c570fc0163f439 @zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfiltrates them to...

Brave Desktop 1.93.132 Security Fixes

Added validation for Tor bridge list as reported on HackerOne by z3phyrus. - Fixed Widevine install prompt as reported on HackerOne by syarif07. Upgraded Chromium to 151.0.7922.76 — refer to Google Chrome advisories for inherited CVEs...

MAL-2026-12116 Malicious code in tailwind-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0348430af0110be6ac537a38b5bb98983ec6b6f8f1474778ff16e4a4f4e8d8 dist/index.js appends an evalatob'...' payload after the legitimate export default scrollbarHide; line. The decoded payload queries Ethereum RPC...

MAL-2026-12110 Malicious code in ethereum-sign-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6f2998ee6903e6a20b55e371b8b074fb130d3e4c6f6d489999fd61f7e536673 On npm install, the package's postinstall script node postinstall.js, declared in package.json scripts.postinstall reads installer-side secret files...

MAL-2026-12080 Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12056 Malicious code in @zzzgenesis00/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8 On npm install, postinstall.js executes and enumerates installer-side secrets: files under /.ssh non-.pub private keys, /.npmrc, /.gitconfig,...

Malicious code in boardwalk-js-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aceb6d52ccfbb88b344c7edfe504516e6496f7886f95a8fec3b69c5127bd2924 package.json declares preinstall: node index.js. On npm install, index.js collects the installer's hostname, username, homedir, DNS server list, and...

Malicious code in @zzzgenesis00/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28a7a4b265a274814769439b7bcc3e03e573308ac72036558815feabfec0c8af The package @zzzgenesis00/playwrite is a typosquat of playwright. Its exported launch returns empty stub methods, while postinstall.js also loaded...

Malicious code in bigops-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a2b7c0da202027f856d059a571a04e01fd992845a158dcd01dfcd1bea4000bb The package advertises itself as an eslint helper but, on require of index.js, unconditionally loads helpers.js which fetches an OS-specific executab...

Malicious code in greatcall-customers-commandapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9 [email protected] is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declare...

Malicious code in bigops-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a The package's main entry requires ./ext, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bigops-auth-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba54cfc2b542b8e388d852b80c0f409b2987423285eb6518d6dbc668e4c1a372 [email protected] executes an install-time binary dropper on any require/import of the package. index.js top-level runs require'./setup', whic...

MAL-2026-12044 Malicious code in specials-mvno-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 852448e1055feb834486a41aaf7e1a621a52fc4e9a496f34c0bde833e751434b index.js requires bootstrap.js at module load, which fetches an opaque platform-specific binary from string-split Cloudflare Workers hosts...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12049 Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

[SECURITY] Fedora 44 Update: perl-5.42.3-525.fc44

Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

Malicious code in @tuluax/errb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561541f6fdbe9bd25716c6fb8a3326df9cbe7a78e7c972d89e36a1c9afc7a186 package.json scripts.install runs node -e "require'childprocess'.spawn'node', 'index.js', detached: true, stdio: 'ignore' .unref", causing npm instal...

MAL-2026-11993 Malicious code in @tuluax/errb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561541f6fdbe9bd25716c6fb8a3326df9cbe7a78e7c972d89e36a1c9afc7a186 package.json scripts.install runs node -e "require'childprocess'.spawn'node', 'index.js', detached: true, stdio: 'ignore' .unref", causing npm instal...

Malicious code in emulative (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DN...

MAL-2026-11996 Malicious code in emulative (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DN...