MAL-2026-17661 Malicious code in hardhat-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02 The package is published as hardhat-pack, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript...

MAL-2026-17654 Malicious code in abbishal-poc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...

MAL-2026-17658 Malicious code in hardhat-bits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e10f22980d33eea7649312f6b2b0a94637e5b4da400f7d585c58b6902a77944 The package is published as hardhat-bits but its README, LICENSE, docs/, and lib/ files are copied verbatim from the pino logger project, providing...

Malicious code in hardhat-option (npm)

[email protected] was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like [email protected] published the day before, the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger README badges still point to pi...

MAL-2026-17660 Malicious code in hardhat-option (npm)

[email protected] was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like [email protected] published the day before, the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger README badges still point to pi...

Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

MAL-2026-17657 Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....

MSC-2026-12694

Version 0.5.144 of the npm package tensorlake was published from a compromised maintainer identity and contains embedded malicious code. The payload harvests developer credentials, including GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins and AI-too...

Malicious code in function-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551ba64ea86ca7d7839dcd058b2c567604c534134e2a6e13f84af340c2db4aac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17647 Malicious code in function-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551ba64ea86ca7d7839dcd058b2c567604c534134e2a6e13f84af340c2db4aac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in function-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41710fdfae55850258c24f8be4df71e28d46d964cec0faa6def842369592ed2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17648 Malicious code in function-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41710fdfae55850258c24f8be4df71e28d46d964cec0faa6def842369592ed2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in animatecss-tailwind-adapter (npm)

animatecss-tailwind-adapter 2.0.6 was published to npm on 2026-07-28 by the account grant587holloway. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment...

Malicious code in animatecss-tailwind-bridge (npm)

animatecss-tailwind-bridge 2.0.6 was published to npm on 2026-09-13 by the account bennetwild. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

Malicious code in tailwind-animatecss-uniform (npm)

tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

MAL-2026-17666 Malicious code in animatecss-tailwind-bridge (npm)

animatecss-tailwind-bridge 2.0.6 was published to npm on 2026-09-13 by the account bennetwild. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

MAL-2026-17667 Malicious code in tailwind-animatecss-uniform (npm)

tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

MAL-2026-17665 Malicious code in animatecss-tailwind-adapter (npm)

animatecss-tailwind-adapter 2.0.6 was published to npm on 2026-07-28 by the account grant587holloway. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment...

MAL-2026-17646 Malicious code in tailwindcss-animatecss-keyframes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 899fab6d3e500a876f1edc1f38356bddbceba9eb47b26d2eb43ae953557342be The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...