Malicious code in core_main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e64170304c1f55aeeca3c096c224c5fe6301dafbd331bb943d08fc1a4bf0588f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @fdr-mar/promos-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0ff10da2d93550bf81006c507400661d5d6d163e7ed31fd2dabc6c3d9be805e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15648 Malicious code in @fdr-mar/promos-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0ff10da2d93550bf81006c507400661d5d6d163e7ed31fd2dabc6c3d9be805e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in kendo-angular-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 012a21168890d2cc7482e8f4191dd4d1ee848314bdf7bc0970be32fb87a7ef25 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15668 Malicious code in core_main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e64170304c1f55aeeca3c096c224c5fe6301dafbd331bb943d08fc1a4bf0588f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15671 Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...

AKRASIA: Stealthy Backdoor Attack on Reasoning-Based Code LLMs

We present AKRASIA, a stealthy, inference-time backdoor attack against reasoning-based Code LLMs. AKRASIA aims to achieve a backdoor target e.g., malicious code execution in reasoning LLMs while evading automated defenses and human inspection. To achieve this, AKRASIA probes the victim LLM to...

MAL-2026-15820 Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

Malicious code in @testrelic/appium-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b67d6f23451a756c154b86142f91615f5c08c415166c1f66216c8c83d74cbeb The package registers scripts/postinstall.cjs as an npm postinstall hook. Alongside a benign-looking config-writer, the script contains an obfuscatio...

MAL-2026-15647 Malicious code in @testrelic/appium-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b67d6f23451a756c154b86142f91615f5c08c415166c1f66216c8c83d74cbeb The package registers scripts/postinstall.cjs as an npm postinstall hook. Alongside a benign-looking config-writer, the script contains an obfuscatio...

Malicious code in hyperliquid-composer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fb2b7d17a47aa4fcd585374f33063197f52d6ba8619e4105ae5a1d30331bb62 bin/cli.js also declared as the package main collects the installer's username via whoami / os.userInfo, plus os.hostname and platform, and POSTs the...

MAL-2026-15627 Malicious code in hyperliquid-composer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fb2b7d17a47aa4fcd585374f33063197f52d6ba8619e4105ae5a1d30331bb62 bin/cli.js also declared as the package main collects the installer's username via whoami / os.userInfo, plus os.hostname and platform, and POSTs the...

MAL-2026-15630 Malicious code in mfafix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f10490485dfd11cdb9eeb6e29b104c0d70651d1d8853a339a7420a75d09d066 lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the exported initMFA flow whic...

Malicious code in kisama-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0179b9fe97920f04431eb6d6e94b46c6ef2889af5e55d6a0b79793097187fed3 [email protected] ships an obfuscated index.js that runs an HTTP+WebSocket agent binding 0.0.0.0:8000 by default and exposing /api/exec POST for shell...

MAL-2026-15645 Malicious code in kisama-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0179b9fe97920f04431eb6d6e94b46c6ef2889af5e55d6a0b79793097187fed3 [email protected] ships an obfuscated index.js that runs an HTTP+WebSocket agent binding 0.0.0.0:8000 by default and exposing /api/exec POST for shell...

MAL-2026-15644 Malicious code in @pipi596888/ccursor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @pipi596888/ccursor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in selfsigned-certificate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26324f10054a4b02e6d50af8f5373115e113a01c37d636ed70df2be1dd1b6b92 index.js contains a hidden code path where calling the library's generateCertificates API with the value 10 triggers loadSampleCertificates, which...

MAL-2026-15623 Malicious code in selfsigned-certificate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26324f10054a4b02e6d50af8f5373115e113a01c37d636ed70df2be1dd1b6b92 index.js contains a hidden code path where calling the library's generateCertificates API with the value 10 triggers loadSampleCertificates, which...

MAL-2026-15603 Malicious code in pyservercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859 The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long...