Malicious code in boxy-lcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60 The package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers...

MAL-2026-13075 Malicious code in boxy-pkg-deps-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1da74d1d4290df1bf3113989f436e444b8596103ce2a703bb0d6bcbbcff44e0a On require of the package, index.js loads adapter.js and unconditionally invokes setup. setup downloads a platform-specific binary from hardcoded...

MAL-2026-12259 Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d381f80d9b2d3b310ab426d3c51996861b4c320f2926e53ea078da80e832a07 On require of this package, index.js loads vendor.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers hostnames...

MAL-2026-4813 Malicious code in noteparse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 270d4c797fe34bc0b9598608f45add8721f1fa80d1488e4fae750e3a7b38419e noteparse 1.1.27 ships live MinIO credentials in configReader.py endpoint uicfile.uniview.com, accesskey 'uicpro', secretkey 'uicpropass123' that are...

MAL-2026-3683 Malicious code in @dropout-ai/runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2121b923a39177ed68ce5cf066cbb07891b7cb5d20ecf5ec66f2c953634eff10 On require/import, src/index.js replaces global.fetch with a wrapper that intercepts every fetch whose URL matches openai.com, anthropic.com,...