MAL-2026-13465 Malicious code in vite-vue-path-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6841df6c82f556057129d7bf3f23a6cccff9da407678d980875c5529e40caa9 The package is advertised as a Vite plugin that generates a local pathInfo.json map, but its generateBundle hook appends obfuscated JavaScript to the...

Malicious code in opencode-optimised-toolings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c On plugin load, [email protected] runs SelfPatchPlugin.runSelfPatch without user prompt. It downloads an OpenCode source tarball from...

Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...

MAL-2026-13454 Malicious code in poc-ch4rlygr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04 On require/import, index.js collects os.hostname, os.arch, dirname, os.userInfo.username, and the full contents of process.env serialized via...

MAL-2026-13476 Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

MAL-2026-13475 Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

MAL-2026-13477 Malicious code in svelte-visual-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13b68e25df054313067ca459b865ea19afd38a9c4b8c90a02a6f56bd4475cf6f No a static rule matches and no traced behaviors of concern were identified in this package version. The tarball does not exhibit lifecycle-script...

Malicious code in @lyxa.ai/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a32d4762c92b12ad7fd0567dfa0f07470a01884303acdc7a3585bfb4ad7fff2 The exported bootstrapCore unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded credentials for the author's...

MAL-2026-13434 Malicious code in @lyxa.ai/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a32d4762c92b12ad7fd0567dfa0f07470a01884303acdc7a3585bfb4ad7fff2 The exported bootstrapCore unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded credentials for the author's...

MAL-2026-13431 Malicious code in @itsreduxtm/unpkg-xss-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39614132e3675ec887b41aa6834ac54cce90e248d43f008345444b86e1870d82 payload.js is declared as the package main and runs an IIFE immediately on require/import. It fetches a wordlist of Linux binary names from...

Malicious code in @itsreduxtm/unpkg-xss-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39614132e3675ec887b41aa6834ac54cce90e248d43f008345444b86e1870d82 payload.js is declared as the package main and runs an IIFE immediately on require/import. It fetches a wordlist of Linux binary names from...

Malicious code in nms-dashboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601 [email protected] declares an npm install lifecycle hook scripts.install: "node index.js" that unconditionally requires ./lib/core inside a...

MAL-2026-13451 Malicious code in nms-dashboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601 [email protected] declares an npm install lifecycle hook scripts.install: "node index.js" that unconditionally requires ./lib/core inside a...

MAL-2026-13437 Malicious code in aitable-workflow-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9fd48b8764ece5b776ed22530ce8c86ffef1093f52fc74ab00fbb740817af82 The package's dist/index.js contains code combining OS command execution ping with outbound HTTP POST requests, a pattern consistent with host...

Malicious code in aitable-workflow-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9fd48b8764ece5b776ed22530ce8c86ffef1093f52fc74ab00fbb740817af82 The package's dist/index.js contains code combining OS command execution ping with outbound HTTP POST requests, a pattern consistent with host...

Malicious code in connect-contingency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a03c555705f2bfa2e63b96e9ea5740196d1ea5ca8be0f1acce290c771f01ea [email protected] is a hollow package whose index.js is an empty stub. Its package.json declares its sole dependency ltidisafe as a direct...

Malicious code in merchantweb-lang-cookie-reset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be package.json declares the sole dependency packet-table-thread-stream as a direct tarball URL to a non-npm host...

MAL-2026-13429 Malicious code in @avi892nash/aegis-grid-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00 The package's default bin action starts an HTTP server grid.mjs that listens on GRIDRUNNERPORT default 7719. Incoming requests carry a base64-JSON...