Malicious code in @itsreduxtm/unpkg-xss-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39614132e3675ec887b41aa6834ac54cce90e248d43f008345444b86e1870d82 payload.js is declared as the package main and runs an IIFE immediately on require/import. It fetches a wordlist of Linux binary names from...

MAL-2026-13451 Malicious code in nms-dashboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601 [email protected] declares an npm install lifecycle hook scripts.install: "node index.js" that unconditionally requires ./lib/core inside a...

MAL-2026-13436 Malicious code in @wbnr/frontend-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username...

Malicious code in @leejungkiin/awkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add The package ships scripts/dependency-manager.js which, when run as part of the install lifecycle, invokes execSync'curl -fsSL...

MAL-2026-13427 Malicious code in @leejungkiin/awkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add The package ships scripts/dependency-manager.js which, when run as part of the install lifecycle, invokes execSync'curl -fsSL...

Malicious code in @activepieces/piece-google-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d347d6252c2a1bb21b4318c0a319be36d60a95b4146d91108cee13d52c5759 The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports childprocess, invokes ping-style OS command...

MAL-2026-13377 Malicious code in ezdiscordbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a715452291e1bd779802f51dc90eca91740307e0bee7b9e2ca94f6f863f6a921 package.json declares a postinstall script sudo node install.js that runs install.js with root privileges on the installer's machine. Both install.js...

MAL-2026-13348 Malicious code in lakk-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52 [email protected] runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's O...

Malicious code in lakk-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52 [email protected] runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's O...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at...

MAL-2026-13313 Malicious code in dolyame-boxy-independent-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfda80d3053a8c106f2665b5c1a9a9235532a4acca7abd2a436b5c69fe7673d6 On require of the package's main entry, runtime.js fetches an opaque native binary from anonymous Cloudflare workers.dev subdomains...

MAL-2026-13311 Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

MAL-2026-13138 Malicious code in dolyame-ui-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7679dd0e86411f0df5eea8392ad6f6a663ab0d911cd674b3ef4605af846cb323 On require of dolyame-ui-breadcrumbs, index.js loads bridge.js which reconstructs C2 hostnames at runtime via string-splitting/array-join resolving t...

MAL-2026-13124 Malicious code in ded-aa-liza-ded-aa-liza-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074f0a8014fabe8bdb281c1c07180290bcff2b10d67d723f1c7917ea198d5c5a On require of ded-aa-liza-ded-aa-liza-core, index.js loads ext.js which downloads a platform-specific binary from hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55e6fcb5f8524548ac64acbf658f83a4b610700e0201d3ffe225fcd9d34f7ae2 On require of the package, index.js loads support.js which assembles Cloudflare Workers hostnames via split-string concatenation...

MAL-2026-13169 Malicious code in dolyame-ui-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df3e9dd433a891fcca85ed4a7302185b3eccece39df2db60ab540b0ebed8631b On require of this package, index.js unconditionally loads bridge.js, which downloads a platform-specific native executable from Cloudflare Workers...

Malicious code in dolyame-ui-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd [email protected] is a dropper disguised as a UI/telemetry package. index.js unconditionally requires./adapter.js, which on module load downloa...

MAL-2026-13188 Malicious code in dolyame-ui-swiper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a On require of the package's main entry, bridge.js unconditionally runs an init routine that selects an OS-specific target path, downloads an opaque...

MAL-2026-13201 Malicious code in dp-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec4c10894526621b93c3dba8f579e76be53db3989ab0ddb32c72bff180266786 The package advertises itself as a web header library but its index.js unconditionally requires ext.js on load. ext.js downloads a platform-specific...