CVE-2026-45321-Tanstack

Supply Chain Attack シミュレーション — CVE-2026-45321 TanStack npmサプライチェーン攻撃、CI/CD悪用、インストール時コード実行の理解を目的とした教育用ラボ 免責事項 このプロジェクトは以下の目的でのみ作成されています： サイバーセキュリティ学習 防御的セキュリティ研究 ローカルラボシミュレーション サプライチェーン攻撃の概念理解 このプロジェクトを以下の目的で使用しないでください： 実際のシステムへの攻撃 認証情報の窃取 マルウェアの展開 不正アクセス その他の違法行為 説明 このラボは以下のインシデントの基本概念をシミュレーションしま...

Malicious code in preinstall-hook-webhook-callback-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1 package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an...

Malicious code in cspell-esm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e857800f57969e257ed22cd056f2e4a4395de09ac9b69becd0c7c2b931314ab Package name resembles the widely-used 'cspell' library but its main entry index.js exports an empty object and provides no functionality. Its...

Malicious code in resolve-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c [email protected] is a stub package index exports an empty object whose package.json declares its only dependency ltidisafe as a direct HTTPS...

MAL-2026-13737 Malicious code in @openzeppelin-4/contracts (npm)

@openzeppelin-4/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v4 line via the look-alike scope @openzeppelin-4, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

MAL-2026-4804 Malicious code in @leviyuan/lodestar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c295b3a16fad72f7b165d049e75feb88883dcc1b5b8d9d72b52ac7b40aa09ba The package ships a lifecycle-invoked script dist/lodestar-setup.js that performs an HTTP POST to a hardcoded https://open.feishu.cn endpoint, with...