MAL-2026-10649 Malicious code in @saladin0x1/js-shared-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b34c6719686343f42df5a2257649104f50ac91ae01ac81d34f182075dc943ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10625 Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

MAL-2026-10651 Malicious code in iwsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10650 Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10652 Malicious code in json-bigint-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bfb97f2d263cd34365f40866529d6c55ee567f38b5d5571ce6b16e49469bfc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10622 Malicious code in chai-as-structured (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9508b72d48575443d9e68f1da1ef6bdd1ebc9351f271fba56b563701f03e56e2 The package name evokes chai-as-promised but the shipped code presents itself as pino middleware. When the middleware factory in index.js is invoked,...

MAL-2026-10621 Malicious code in chai-as-hardened (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20c6afe564cf46f02258e635c1b08a802cd4f9b949e098710f44544cdbb86dfd On require, index.js spawns a detached Node child process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL...

MAL-2026-10614 Malicious code in postcss-selector-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fec62079856815ded46ba283769d3d3e0d20e08b6196b8698e08e2df6677ee Package is published as postcss-selector-minify a word-order permutation of cssnano's widely used postcss-minify-selectors and registers itself to...

MAL-2026-10606 Malicious code in base58-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772 The package's index.js contains multiple Buffer.from... decode sites lines 7, 29, 34, 49, 50 used to reconstruct strings/payloads at runtime — the...

MAL-2026-10598 Malicious code in monitoring-service-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb0e7dea7e0302bc22488fbaf436dd36c0763f05ef494977822e8a1b7b3a1ab The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10597 Malicious code in monitoring-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b39cb760b9b8a911efb3acc8389158d2a679ff9eb104da35496a6cccb1df6e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10596 Malicious code in @ayunlove/bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8fc6c8b6ac94f8325f4aa6958480a40a9e8b912f7007f11e86a41ab13106894 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10595 Malicious code in nodemon-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c287effa0f498762ab73bfc0e4428b4d0afbc05435b1613459f9024d0b97927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in nodemon-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c287effa0f498762ab73bfc0e4428b4d0afbc05435b1613459f9024d0b97927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10586 Malicious code in crypto-validate-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d8b69cab723043b20a628a6cd17f0e5cc64051004d9beb43d4b9ed58dbd9a0 index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtures/keypairs.dat a 53KB opaq...

MAL-2026-10591 Malicious code in solana-key-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92 On require, index.js waits 37 seconds, reads test/fixtures/keypairs.dat a 53KB base64 blob disguised as a test fixture, no test harness references it...

MAL-2026-10580 Malicious code in ethers-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3959190c7c321e0d6f512b89b3c54a6399f3e6f7daecd0563ff753a6a6fed2f5 Package name typosquats the popular 'ethers' library. package.json declares a postinstall pointing at dist/index.min.js, whose sole top-level stateme...

Malicious code in @akshajrawat/plugin-repo-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 596ef9a9a6888c00110ee80e3633052ed89887a8465e9a5eaa824a81e5211e46 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10554 Malicious code in @akshajrawat/plugin-repo-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 596ef9a9a6888c00110ee80e3633052ed89887a8465e9a5eaa824a81e5211e46 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...