Malicious code in mcp-server-supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdd7519780160ab3a92639d54eab0a62f08b3d435e61276f4ba599c638c3cd40 Package name impersonates the official scoped Supabase MCP server. package.json declares "postinstall": "node index.js", which fires automatically on...

MAL-2026-4638 Malicious code in pewter-constantstest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050b19d8dad7c8c1a626c953493c23b375e434128f38950625f82b0fb244eabe On npm install, the preinstall script callback.js collects the installer's hostname, OS username, current working directory, npm registry...