MAL-2026-14055 Malicious code in harmony-app-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...

MAL-2026-14052 Malicious code in require-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...

Threat-Scanner

playwright-core This...

MAL-2026-14071 Malicious code in @peptideventure/peptide-score-modifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9087a96f9eff6ac558764d4ba1ec4427d1d251447f891d1a62b58ee764d9ab1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14072 Malicious code in @peptideventure/peptide-unit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 155eb4b5267fa1257d06da30180a29bfd92d5779539c9ffd2160ba836cc7f96f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14047 Malicious code in @guangnao/agent-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06 On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint hub.client-llm.com, reconstructed...

MAL-2026-14046 Malicious code in @ghost_debugger/nanocache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c027fa29f4577bd052bfda553a617994365ea5855216b877e900610542f4bcce On require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored...

Malicious code in @ferudionz/web_logger_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42924eef53202ac8b42a142da91ff30445dab53dcf185fa4798efd4d40d1b095 The package ships a single obfuscator.io-style index.js with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug...

MAL-2026-14042 Malicious code in @devmikets/hyperliquid-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.or...

Malicious code in @cdnshell/loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b572368b522527a308a0a8057b3b0945ded5c73f4dcad6ab738eaa2b7ddf6e3 Package presents itself as a CDN static-asset distribution library but ships 19 pre-compiled arm64 Mach-O binaries under 03payloads/ stager, kbridge,...

Malicious code in datefmt-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall...

MAL-2026-14032 Malicious code in datefmt-simple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9 datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fir...

MAL-2026-14038 Malicious code in tailwind-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afeb355b3088d1c03dbbb5a60c1afea5afbe3a384f50417ae6cfa7340d8c072d The package presents itself as a Tailwind CSS plugin, but its default export which runs when users register it in tailwind.config issues an HTTPS...

MAL-2026-14035 Malicious code in notafollower122 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83409fb8c0dc76764a944064219de6a4d59d6b24413db5e36d897681f3183add package.json declares a postinstall lifecycle script that runs automatically on npm install. The script uses childprocess to query the AWS ECS...

MAL-2026-14091 Malicious code in pocbitbarrontest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8730ba23c54aed5d25d755bc1f2ed8809e57cb1996b80d301a5f265a3c09052 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zalastax/nolb-ngd (npm)

The package @zalastax/nolb-ngd was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in @zalastax/nolb-demos (npm)

The package @zalastax/nolb-demos was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in @zalastax/nolb-brown (npm)

The package @zalastax/nolb-brown was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in @zalastax/nolb-_deva (npm)

The package @zalastax/nolb-deva was found to contain malicious code. --- Credit: OpenSSF source...

MAL-2026-14074 Malicious code in @vyzensockets/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65a38578ec3825683bc7646595c0676583ebf4bb3b5c36b5b92c5c7f4537e653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...