MAL-2026-13623 Malicious code in @depup/aws-sdk__credential-provider-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d @depup/aws-sdkcredential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author...

MAL-2026-13621 Malicious code in @decido/backend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8 The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware...

Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

MAL-2026-13668 Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

Malicious code in @catamania/front-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5 The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.userInfo username, process.cwd...

MAL-2026-13615 Malicious code in agenthub-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29f622134cd387e49d4293fb004554b677e44f972187d6798d6c885a3aa5b0 The package runs as a persistent daemon that opens a WebSocket to the hardcoded production endpoint wss://agenthub-agent.fyenet.com and dispatches...

MAL-2026-13617 Malicious code in ts-utility-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75e338acac1218e74bb44a4141ac9eb195da36f48eef6f4b1d11c84fe92a96ef The package's default export getPlugin performs an HTTPS request to a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/109 and passes...

MAL-2026-13613 Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

Malicious code in f-termx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f050d397c72fdb9336deba1e2ca6758d04625323e7bb4746d8b61964cc671ae The package's main entrypoint index.js and src/server.js start an HTTP + Socket.IO server bound to 0.0.0.0 and are designed to be published to the...

MAL-2026-13610 Malicious code in f-termx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f050d397c72fdb9336deba1e2ca6758d04625323e7bb4746d8b61964cc671ae The package's main entrypoint index.js and src/server.js start an HTTP + Socket.IO server bound to 0.0.0.0 and are designed to be published to the...

MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...

Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

MAL-2026-13522 Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

MAL-2026-13539 Malicious code in delivery-ci-codeceptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0287654a4d9fa3f7e6f9a35c8bf06a8bb4f18fbbc3a5b3df3450a6c681897b49 On require of the package's main entry, helpers.js runs a setup routine that selects a platform-specific payload path via a DLMAP table and downloads...

MAL-2026-13574 Malicious code in dolyame-ui-inputautocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an...

Malicious code in dolyame-ui-inputautocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an...

MAL-2026-13547 Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

MAL-2026-13577 Malicious code in dolyame-ui-inputdate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from...

Malicious code in delivery-ci-jira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d On require of delivery-ci-jira, vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts...