MAL-2026-16383 Malicious code in mxdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...

MAL-2026-16380 Malicious code in chai-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 566e54855d730e8555b93da4f8ea81faba72645079a7adcc3a05ea8bf8ad8ee6 The package presents itself as a Chai logging plugin but its main entry index.js requires ./lib/query.js, a 4 MB obfuscator.io-encoded module...

MAL-2026-16378 Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

MAL-2026-16379 Malicious code in @user-services/web-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b @user-services/[email protected] fires a hidden telemetry probe on both the npm install lifecycle node index.js and on every require of the modul...

Malicious code in @user-services/web-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b @user-services/[email protected] fires a hidden telemetry probe on both the npm install lifecycle node index.js and on every require of the modul...

Malicious code in take-home-caller-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname and os.userInfo, reads...

MAL-2026-16382 Malicious code in take-home-caller-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname and os.userInfo, reads...

MAL-2026-16381 Malicious code in cisco-github-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205 The package declares a preinstall lifecycle hook node index.js that runs automatically on npm install. index.js collects host reconnaissance from the...

MAL-2026-16374 Malicious code in test-react-app-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5f625e91f5a500b87bd2e2d34c625a73bda73a3b9c2e4762b389d42d117be1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-out (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3dd53fc6c31b6410f38c097f6d542696fae75c2c4a4b5ed41cc2b85955042e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16375 Malicious code in test-react-app-out (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3dd53fc6c31b6410f38c097f6d542696fae75c2c4a4b5ed41cc2b85955042e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16372 Malicious code in @zig-design-system/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1247992d3c2b02f93cea726189a4ff0a25eef9535b2a34eb7a120f8c9496f67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zig-design-system/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1247992d3c2b02f93cea726189a4ff0a25eef9535b2a34eb7a120f8c9496f67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview action-slack-message-root is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview test-react-app-in is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview test1gg234 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview keroeltop is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-16371 Malicious code in @vite-tab/tabui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5178b465689483c264c60f883fe971a7fa7c9332b22a10281b652f6262c7731d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

MAL-2026-16370 Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...