Malicious code in decode-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 645d703f4bbd5a7aedaa60a60b7d20af253d4da8efaf82cbac3520a8f21d67b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6740 Malicious code in decode-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 645d703f4bbd5a7aedaa60a60b7d20af253d4da8efaf82cbac3520a8f21d67b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @jacobtan/decode-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a99e8b0d7812c216410fc0ff557698f61a595d4ded8579c18fab63ab3ac8b924 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6738 Malicious code in @jacobtan/decode-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a99e8b0d7812c216410fc0ff557698f61a595d4ded8579c18fab63ab3ac8b924 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6734 Malicious code in horde-python-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ae9afcd7af22c82b137c1142ae643502d82f3d1f28712b2e5c7ec412bea85e horde-python-client 99999.0.0 is a dependency-confusion lure. On import hordepythonclient, a daemon thread unconditionally POSTs a JSON payload...

Malicious code in ue-automation-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbc2db9a2a365d53d76fe7ca2a8f219f98118d99b53698cf7ce8b31cf81eda3f Package name 'ue-automation-scripts' with version 99999.0.0 is the canonical dependency-confusion shape used to hijack installs on internal CI system...

MAL-2026-6729 Malicious code in robomerge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b8f632bbc34b020f78b4dec06ddf1bc50194ce117dfe609484d05edc76d7790 package.json declares a preinstall lifecycle script that fires automatically on npm install. The script collects installer hostname, username, cwd,...

Malicious code in unreal-horde-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cf7eca1e6de1e7ecc5fe67d8094125f20f6ca4256e843b72e89760c97888b8 [email protected] executes a preinstall script that runs automatically on npm install. The script collects host identifiers hostname,...

MAL-2026-6728 Malicious code in dt-validator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0dd6dc392ad68861c938e7798773adf5359c835743e711a834d84221b481bdf The package's top-level public API dtvalidator.validate — colocated in all with legitimate helpers validateextension, validatesize, and...

MAL-2026-6727 Malicious code in tailwind-animates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da1c506d3ce6cb8bac934a9b51e967b8c2965de414adb1193ba38a64934a78c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-50195

A flaw was found in containerd, an open-source container runtime. The CRI Container Runtime Interface checkpoint import process fails to validate image references within a checkpoint image's configuration. An attacker with permissions to create pods can exploit this by using a specially crafted...

MAL-2026-6726 Malicious code in db-convertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7480b95a12688a84f3efd3d4c5c8a82c5c761f1f462eb22201f4385fb9bf691c index.js defines a method queryDBConnect on the exported DivbloxDatabaseConnector class that base64-decodes a hardcoded constant HASHKEY to the URL...

Malicious code in db-convertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7480b95a12688a84f3efd3d4c5c8a82c5c761f1f462eb22201f4385fb9bf691c index.js defines a method queryDBConnect on the exported DivbloxDatabaseConnector class that base64-decodes a hardcoded constant HASHKEY to the URL...

MAL-2026-6725 Malicious code in @modhamanish/rn-mm-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bafa948cdfb9fda0d33e923e0e352a384adecfaaab1ece9a20b1b645c1b58ae6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @modhamanish/rn-mm-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bafa948cdfb9fda0d33e923e0e352a384adecfaaab1ece9a20b1b645c1b58ae6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6716 Malicious code in test-pkg-pnpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo...

MAL-2026-6719 Malicious code in ts-clob-math-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9 On npm install, the postinstall script scripts/install-check.cjs resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.ap...

MAL-2026-6721 Malicious code in ts-eslint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5bbed232e0268a791ce846260ce170342eec359bf1a7e84b9514767d77803a1 The package's index.js defines run/fromstr that recursively walk process.cwd and match files named.env, env, id.json, config.json, config.toml,...

Malicious code in twrap-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9903cc9163ada9951dee4ee1f364648cac0e492df9a32582ad3ed8303d29231 twraptool/init.py defines two public functions, formatblock and aligncolumns, whose real behavior is to fetch a Python file from...

Malicious code in hardhat-compile-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb9781577ff17698d2cb66a6cd832fe8bdda014b30c0c662055a45d42801ac1 The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/import e.g. when Hardhat load...