Malicious code in file-type-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72 A clone of file-type-checker with one function added: isSignname, moduleName, offset in dist/validation/image.js reads public/$name.png from the...

MAL-2026-16053 Malicious code in file-type-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72 A clone of file-type-checker with one function added: isSignname, moduleName, offset in dist/validation/image.js reads public/$name.png from the...

Malicious code in gloggo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d gloggo impersonates the legitimate gulpjs 'glogg' logging library by copying its README, shields, and LICENSE text attributed to Blaine Bublitz, whil...

MAL-2026-16058 Malicious code in vinzz-wcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dec0212466f7170f1e00ecbfe3f846cbf5d211917c3831a6ee162ca6d44ec10 vinzz-wcli is a WhatsApp CLI whose main entry index.js sets global.ownerr = "[email protected]" and treats any incoming WhatsApp message...

MAL-2026-16057 Malicious code in toru-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...

Malicious code in tailwind-aspect-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in th...

MAL-2026-16056 Malicious code in tailwind-aspect-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in th...

Malicious code in tailwindcss-aspectratio-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b995eb02f80f9037beda9f8a864f55109e054925175289df0c1b29ed8011bc3 src/index.js, referenced by the package main and executed on require, performs an HTTP GET to http://tailwindlan.online, writes the response body to ...

MAL-2026-16049 Malicious code in tailwindcss-aspectratio-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b995eb02f80f9037beda9f8a864f55109e054925175289df0c1b29ed8011bc3 src/index.js, referenced by the package main and executed on require, performs an HTTP GET to http://tailwindlan.online, writes the response body to ...

Malicious code in @usemosaik/template-react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...

MAL-2026-16047 Malicious code in @usemosaik/template-react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...

MAL-2026-16046 Malicious code in i18nexus-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 558344f06c374c5eff9c870250d63a5e9f784ffe23f91182154d9c66c441ee0b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in i18nexus-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 558344f06c374c5eff9c870250d63a5e9f784ffe23f91182154d9c66c441ee0b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in i18nexus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37d8dfb4ceaec110414441ebad5da37dad342ef653a20499504385d9db1ffdac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16045 Malicious code in i18nexus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37d8dfb4ceaec110414441ebad5da37dad342ef653a20499504385d9db1ffdac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @web2apk/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad4c3329ebb2fdeb3b9ddc93abcb5f3dab6773f7a7999ff96d063d49edc04d9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16043 Malicious code in @web2apk/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad4c3329ebb2fdeb3b9ddc93abcb5f3dab6773f7a7999ff96d063d49edc04d9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

Malicious code in plogme (npm)

plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys MAL-2026-15917, and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js javascript-obfuscator output, identical t...