MAL-2026-10660 Malicious code in saurus-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c66bed79555a8ded86c45232c26e4b94785b5789d2b681a93e92c93ef95eb966 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10631 Malicious code in core-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad83962ee4db02c1bf43558ed5fe6bf79f66754b070415223d29643a8ff754e core-dotenv presents itself as a dotenv/env-var wrapper. On calling the package's config or get, which lazily invokes config, a worker plugin.worker....

MAL-2026-10633 Malicious code in creditgauge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0bd064afe94f426f1124703c1c1f7ac52ee1ad1df728c33ce7cbe4328bae876 The package has no functional library code: package.json declares main=index.js but no index.js is shipped; the tarball contains only package.json an...

Malicious code in webpack-session-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0007695a788bff7d6d0a87ee48de6771c12a1e21241bd3fc0bc7b5509608533e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10640 Malicious code in polygon-toolkit-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c3f2f27ce890479049767726c06bf083f96fe5c9916f43f5345f62ed9671c1 The package exposes validatet and randomBytest,e which route their arguments through an internal checkvalidator that base64-encodes the value and...

MAL-2026-10647 Malicious code in @bcs-mi-ui/test1243npmpacket76 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9e1e6c4d6beaeee572dffd24a67ae5bc74026eb798b1677a1dfa52144e15aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10645 Malicious code in @bcs-mi-ui/message (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6f4bc902c3be307322df1b9d7f35ffae7ac2e7b0cf6d0cd2799adbb90219471 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10646 Malicious code in @bcs-mi-ui/message-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58c86304011c297c4b10092f83a6dc1763b8174e91fd9e81f8487b959ecea539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10636 Malicious code in leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b0bed6337ffe527af2615fed8ae1ecbb449f6a6cb00afa6381f7811ec88956 [email protected] ships src/poc/index.js which uses childprocess.exec to run a shell pipeline that collects host reconnaissance data hostname,...

Malicious code in @hkyyy/portal-widget-helper-0601 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72e27d8bfbf5b9bfefe661d642be934399a38031c1bee028a20ed3282e0f482 The package has no real functionality — index.js only exports ok: true — and its sole effect is to run a postinstall reconnaissance script...

MAL-2026-10648 Malicious code in @hkyyy/portal-widget-helper-0601 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72e27d8bfbf5b9bfefe661d642be934399a38031c1bee028a20ed3282e0f482 The package has no real functionality — index.js only exports ok: true — and its sole effect is to run a postinstall reconnaissance script...

MAL-2026-10649 Malicious code in @saladin0x1/js-shared-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b34c6719686343f42df5a2257649104f50ac91ae01ac81d34f182075dc943ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10625 Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

MAL-2026-10651 Malicious code in iwsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10650 Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10652 Malicious code in json-bigint-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bfb97f2d263cd34365f40866529d6c55ee567f38b5d5571ce6b16e49469bfc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10622 Malicious code in chai-as-structured (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9508b72d48575443d9e68f1da1ef6bdd1ebc9351f271fba56b563701f03e56e2 The package name evokes chai-as-promised but the shipped code presents itself as pino middleware. When the middleware factory in index.js is invoked,...

MAL-2026-10621 Malicious code in chai-as-hardened (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20c6afe564cf46f02258e635c1b08a802cd4f9b949e098710f44544cdbb86dfd On require, index.js spawns a detached Node child process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL...

MAL-2026-10614 Malicious code in postcss-selector-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fec62079856815ded46ba283769d3d3e0d20e08b6196b8698e08e2df6677ee Package is published as postcss-selector-minify a word-order permutation of cssnano's widely used postcss-minify-selectors and registers itself to...