Malicious code in react-tabulix-virtual (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbfc5a819e6dfbc3c65ec83a79a9f93a95da71259279c54e95f34c36ab81a22f The OpenSSF Package Analysis project identified 'react-tabulix-virtual' @ 0.1.1 npm as malicious. It is considered malicious because: - The...

MAL-2026-10987 Malicious code in react-tabulix-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...

MAL-2026-10974 Malicious code in rasterkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875 This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an...

Malicious code in fluffy-octo-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f fluffy-octo-broccoli ships a 10.7 MB qiwi.zip archive whose contents yield no readable filenames or strings via extraction, alongside a run.sh that...

MAL-2026-10968 Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...

MAL-2026-10967 Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 84f718c6b68fba15ac3506964439bc33c409cef1390f6cb22fa5a86d074e3a42 The OpenSSF Package Analysis project identified 'commonweb-moneymovement' @ 99.9.1 npm as malicious. It is considered malicious because: - The...

Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

MAL-2026-10939 Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

MAL-2026-10929 Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766a0a8222cb9a7a188ad8c88daf73b102036079be073f01661cde1622b99b5 The package exposes a function permprivatekey that POSTs the caller-supplied TRON private key as JSON to the hardcoded URL...

MAL-2026-10928 Malicious code in upjsma (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25730cd7d45983434b20869fb88d5b84fd468d20341080c44adbc2c53778cb3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in upjsma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6da6be7241858aacc6bf0fdef363fad9469efcbd9414b7b6e3e4153eba341f7b The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a fullscreen iframe, and...

MAL-2026-10926 Malicious code in defi-kit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d On import defikit, the module compat.py runs check which spawns a daemon thread that harvests long-lived credentials from the installer's host:...

Malicious code in iot-kfh-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...

Malicious code in alb-lambda-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...

Malicious code in lwc-slds-lbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...

MAL-2026-10924 Malicious code in s3-lambda-dynamodb-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6517c8914c4ba64ce57809484229df7fbe5dd9f5129c40b19cec8a73c10a70ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lambda-cloudwatch-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d62c2ab5388572a03d3c4f28ee268d562675a2ebbff48cf1375728f837365f4 The package's preinstall script npm install @sentry/node && node examples/verify.js executes on npm install and initializes Sentry with a hardcoded...

MAL-2026-10922 Malicious code in lambda-cloudwatch-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d62c2ab5388572a03d3c4f28ee268d562675a2ebbff48cf1375728f837365f4 The package's preinstall script npm install @sentry/node && node examples/verify.js executes on npm install and initializes Sentry with a hardcoded...

MAL-2026-10920 Malicious code in alb-lambda-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...