Malicious code in solidity-lock (npm)

Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB obfuscator.io-style bundle rotating string array, hex-escaped entries,...

Malicious code in @larocas-bbresearch/tombstone-probe-8ejnsa (npm)

Source: amazon-inspector 8656a15600371992dd90c60b5c0280339218d62a8f22473380f37eaf8d952e9b The package was found to contain malicious code or consuming dependency that contains malicious code --- Credit: OpenSSF source...

Malicious code in @larocas-bbresearch/tombstone-probe-odvz5y (npm)

Source: amazon-inspector d8361724bb70f161c897f4b6cc3cfb8d2dd3acf32295a4e32181c8a16dd58d13 The package was found to contain malicious code or consuming dependency that contains malicious code --- Credit: OpenSSF source...

Malicious code in @larocas-bbresearch/tombstone-probe-live-z6xz56 (npm)

Source: amazon-inspector 8eb64220c40c3aaf61d0c2911ff0950a968c4c03d9ba2af1620420077f532a2d The package was found to contain malicious code or consuming dependency that contains malicious code --- Credit: OpenSSF source...

Malicious code in stestenv (npm)

Source: amazon-inspector ee35b23a60484ee1d468154734cc7cdbc8c7d3cbc81901ab680cb67e46a8c2b6 On require of the package's main entry, dispatchAnalytics reads a payload hidden in the JPEG APP13 marker 0xFFED segment of the bundled dist/stest.jpg, decrypts it with a hardcoded AES-256-CBC key to obtain ...

Malicious code in esm-dotenv (npm)

Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke dispatchAnalytics at top-level module load. That function reads...

Malicious code in @larocas-bbresearch/tp-probe-e29834ce (npm)

Source: amazon-inspector 7279432ffb7dc233307df869ac5faaded0fef16333ec8a5948b15bae7bd716a7 The package was found to contain malicious code or consuming dependency that contains malicious code --- Credit: OpenSSF source...

Malicious code in zeal-util-hooks (npm)

Source: amazon-inspector 2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341 postinstall.js and index.js load canary.js, which POSTs a JSON payload to https://npm-canary.aveliscare.com/beacon at install time and on require. The payload contains os.hostname, os.userInfo username, cwd,...

Malicious code in test-supply-npm-lib-4 (npm)

Source: amazon-inspector 80bcbaa6379206627641c70dd25da3c3adfd51337f9a378223a6f8f13c8ba3ed package.json declares a dependency test-supply-npm-git-prepare-proof-4 whose value is a bare git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git rather than a registry versi...

Malicious code in pixsvg (npm)

Source: amazon-inspector 23f6989954f196f485ff049ef7dc22bb800a57187e6bdc8bd0e002ed4bbc1db7 The pixsvg module exports fetchDataFromSvgsvgData, which scans the input SVG for a comment of the form , reassembles the binary-encoded 1/0 sequence into a JavaScript string via binaryToData parseIntchunk,2 ...

Malicious code in booking-eligibility (npm)

Source: amazon-inspector 2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs Windows Script Host against a .vbs file on npm install. The referenced 4444.vbs is not shipped in the tarball, so the hook...

MAL-2026-17316 Malicious code in booking-eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs Windows Script Host against a .vbs file on npm install. The...

MAL-2026-17312 Malicious code in json-bigint-rs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module...

Malicious code in json-bigint-rs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module...

Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

MAL-2026-17314 Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

Malicious code in esm-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke...

MAL-2026-17305 Malicious code in esm-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke...

MAL-2026-17309 Malicious code in stestenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee35b23a60484ee1d468154734cc7cdbc8c7d3cbc81901ab680cb67e46a8c2b6 On require of the package's main entry, dispatchAnalytics reads a payload hidden in the JPEG APP13 marker 0xFFED segment of the bundled dist/stest.jp...

MAL-2026-17302 Malicious code in solidity-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8 The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require'./lib/config', a 4 MB...