MAL-2026-16224 Malicious code in process-mite (npm)

This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

Malicious code in discord-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...

MAL-2026-16214 Malicious code in discord-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...

MAL-2026-16213 Malicious code in discord-players (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eadb25768efba4ff9dc9170a838f90f6572993195d37e526543fa956e65faa2 index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd excluding...

MAL-2026-16216 Malicious code in tetomood (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92 package.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory $pwd and machine...

Malicious code in tetotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6 package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory $pwd and...

MAL-2026-16217 Malicious code in tetotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6 package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory $pwd and...

MAL-2026-16215 Malicious code in engin1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a The package's main entrypoint index.js invokes an initializer at top level that spawns loader.js as a detached background Node process on every...

MAL-2026-16207 Malicious code in chai-as-agile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263 On require'chai-as-agile', index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to...

Malicious code in strapi-plugin-pencc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208 postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname to the hardcoded stri...

Malicious code in strapi-plugin-ccsuc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb6207f1b4ec4d94c724583a5f32b85f68d203e1a9e6372705b410efbf9173a The package's postinstall lifecycle script postinstall.js, wired via scripts.postinstall in package.json checks the installer's hostname against a...

MAL-2026-16208 Malicious code in otel-span-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e800a0d88fb9a757c0ca5ecc09f0217522e72575d3e570a87c167090740de7d The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads...

MAL-2026-16211 Malicious code in swnwall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a On require/import, index.js invokes initialize which spawns loader.js as a detached, hidden background child process detached: true, windowsHide: tru...

Malicious code in jexkcode (npm)

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter suppo...

MAL-2026-16220 Malicious code in jexkcode (npm)

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter suppo...

Malicious Package

Overview kartykp-prod-oidc-test-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16197 Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...