Malicious code in spotify-url-resolovela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045 On require/import of the package's main index.js, a top-level startBackupLoop call runs immediately and reschedules every 60 minutes. It archives the...

MAL-2026-14482 Malicious code in vite-plugin-images-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388 This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the...

MAL-2026-14481 Malicious code in vite-plugin-image-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019affd7dfc88e28b20dcce52fe53661a514582fb11c51871126b967399a01d8 The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script into every produced HTML page...

Malicious code in vite-plugin-image-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019affd7dfc88e28b20dcce52fe53661a514582fb11c51871126b967399a01d8 The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script into every produced HTML page...

Malicious code in vite-plugin-bug-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127a50da55320d2b9e8e99e06d4cccf3d005cc997f3845bcae0738339cd5b882 The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every built HTML page produced by...

MAL-2026-14479 Malicious code in vite-plugin-bug-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127a50da55320d2b9e8e99e06d4cccf3d005cc997f3845bcae0738339cd5b882 The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every built HTML page produced by...

MAL-2026-14480 Malicious code in vite-plugin-image-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04 The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its transformIndexHtml hook injects an inline into...

Malicious code in mham-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0dc3c71ee333b190e3e7202f7a222b4fe242fd50974cda9ec122b4200bd5f4f On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../public/logo.ico, decrypts i...

MAL-2026-14477 Malicious code in js-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500 On module load, src/api/session-api.js reads../../../../public/logo.ico a path outside the package, DES-decrypts the contents with the hardcoded key...

MAL-2026-14471 Malicious code in cat-embed-i18n-res (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c612800e80bb36720e75741be9665ab6acbed58bcd5d51065fcedd1d990aaad0 The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are HTML/JavaScript XSS payloads...

Malicious code in cat-embed-i18n-res (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c612800e80bb36720e75741be9665ab6acbed58bcd5d51065fcedd1d990aaad0 The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are HTML/JavaScript XSS payloads...

MAL-2026-14453 Malicious code in desmoshomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fae975f53feac57fc6aec90279e55e994d6e61d177217b012dfb59c6f42a7e8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14446 Malicious code in classhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ef17879328ca7cff2fac02018b2155038da8e7faf071aa080d9c3272ba87a3d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14467 Malicious code in superdupertest111 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dafc169a0c96b769349ac7685ff37d6ad663db50df14862a784173cde38dbe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14454 Malicious code in desmosisfire (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0679b40ac71c7b8ce0dc0557c8779a85ad10fac03ff678128ec4aa687c5e243 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14458 Malicious code in desmoswork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92541d82d133f0d80ad0e7dd4dc1595038f64af50558f26398c0a1c3627928aa The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14451 Malicious code in classwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf8dab0502db54359ed8c53423750080abd441eae407040f20f205f5b0e10255 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14468 Malicious code in tungtunggod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cfc083fc4a77544ba957b1c1d771998929fc71453f905f6d9c474e2bd3fb51f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14455 Malicious code in desmosistuff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c61a3c57b3649dc23c3534ad9f8b872093353a38ed7995af9cda6d4102bee8b0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14470 Malicious code in whatsgoodlookingbabycreed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e598067256b5fe5407b1f8b201925a118b6a08ea19be59cc80db3c60082fe19b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...