MAL-2026-12090 Malicious code in @wethenorth12/docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae39aac54233ee3235e2cb94f52d5d4e182a6f16d91ac42b9d7add9bd8c00470 Package advertises itself as a 'drop-in replacement for dockerode' but the main module index.js has no Docker functionality. On require, it collects...

Malicious code in @wethenorth12/solana-wallet-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14e7d05f22a60d86ce4aea030108a6f50a69b85ce9bb0219eb59fbe2dbc3bbb2 On require, index.js JSON-encodes the full process.env plus hostname, username, homedir, platform, cwd, and package metadata, base64-encodes the...

MAL-2026-12095 Malicious code in @wethenorth12/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular hdkey wallet library. On require, index.js reads the full...

MAL-2026-12093 Malicious code in @wethenorth12/ethers-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e On require, index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env,...

MAL-2026-12115 Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...

MAL-2026-12112 Malicious code in mnemonic-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc209736a2c44e541e224030a4c0bd7145bb77a17fa66504cd96beedc75ce6f4 index.js executes an IIFE at require-time that reads installer-owned secret files .env,.npmrc, /.aws/credentials, /.ssh/idrsa, ided25519, idecdsa,...

MAL-2026-12056 Malicious code in @zzzgenesis00/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8 On npm install, postinstall.js executes and enumerates installer-side secrets: files under /.ssh non-.pub private keys, /.npmrc, /.gitconfig,...

MAL-2026-12055 Malicious code in @zzzgenesis00/docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2417f0620e130c16865914c5f79fdff63bdda0daf3257955c8fd536ab894c1b1 postinstall.js runs automatically on npm install and enumerates installer-side secret stores including /.ssh, /.npmrc, /.gitconfig, Chrome and Firefo...

Malicious code in beaver-ui-card-large (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cddf97a67fa28e298f65b3f96b200109d5f15a8a6dde49b8bdd025e8052abf2 Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap on process.nextTick so the paylo...

MAL-2026-12059 Malicious code in bcore-bravo-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe55f411284226c68e60cbcae266a390a3ba0ef089a2a709363df3188130f605 The package presents itself as an ESLint config / 'environment config reader' but on require executes an import-time dropper. index.js ends with try...

Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12073 Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12063 Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

Malicious code in hubert-appointment-v2-task-create-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109 On require, platform.js reconstructs destination hostnames from split-string arrays e.g. 'oob-worker.cf103-070.workers.dev' assembled from...

MAL-2026-12066 Malicious code in hubert-appointment-v2-task-create-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109 On require, platform.js reconstructs destination hostnames from split-string arrays e.g. 'oob-worker.cf103-070.workers.dev' assembled from...

Malicious code in bigops-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a2b7c0da202027f856d059a571a04e01fd992845a158dcd01dfcd1bea4000bb The package advertises itself as an eslint helper but, on require of index.js, unconditionally loads helpers.js which fetches an OS-specific executab...

MAL-2026-12061 Malicious code in bigops-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a2b7c0da202027f856d059a571a04e01fd992845a158dcd01dfcd1bea4000bb The package advertises itself as an eslint helper but, on require of index.js, unconditionally loads helpers.js which fetches an OS-specific executab...

MAL-2026-12065 Malicious code in greatcall-customers-commandapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9 [email protected] is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declare...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...