Malicious code in @colibri-event-types/megamarket-ru-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4780aaf3b99e11830e6a5eda56c287f9f8e93d375f1f59320ecc9849ebdf4fe scripts/postinstall.js is registered as the npm postinstall lifecycle script and is heavily packed with obfuscator.io string-array rotation plus a...

Malicious code in simple-node-calc-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9a86d4aeac1d4f5fc458b3058f4b13229cd2097c9d8e5cf3e4d45aa24980ad8 [email protected] advertises itself as a pure-JS calculator but ships a binding.gyp that triggers node-gyp automatically during npm install...

MAL-2026-6415 Malicious code in anthropic-claude-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39eab369e2498da827d3bbd331effdf24b99ab28961e62da7328e4476e328876 Package anthropic-claude-latest claims to be an 'Official Anthropic Claude SDK wrapper' but ships no Anthropic SDK code; the README is for an unrelat...

MAL-2026-6341 Malicious code in react-check-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d89ef9716015743217a9492f4b4469459da701a1b6198851f1527033f1e5c9ae On require, index.js invokes initMsgCache at module top level. The function derives an AES-256-CBC key, IV, and ciphertext from a hardcoded 161-byte...

Malicious code in @outmarket/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e package.json declares a postinstall script that runs automatically on npm install and performs require'https'.get... to a Burp Collaborator subdomain...

Malicious code in @nullzero/urlcat (npm)

@nullzero/urlcat version 1.4.2, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern [email protected], with...

MAL-2026-6209 Malicious code in @antoncarlos1/nodelamp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d930df8b6392b3bbfe3b591d90226374d31fb246e06018521f3f673a815b618a @antoncarlos1/[email protected] ships a single obfuscated index.js that runs a dropper on require. The top-level IIFE constructs a hardcoded IPv4 URL by...

MAL-2026-6183 Malicious code in @mep-exp/api-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 322089c1a58142401c82621aa778cdb7221086196cce6c879a703625b7013555 preinstall.js, registered as scripts.preinstall and also required from the main module and every bin entry, collects os.hostname, os.userInfo.usernam...

Malicious code in abuden218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36e1df12b592dc442d5266d4244831fd0b6ceb94c0960a26815f5fad3246b828 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in set-proto-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdb11eef3afbfc268bd48a18737884246861c7ae9e6a3d29901ae1379216c633 lib/index.js contains a base64-encoded URL decoding to https://jsonkeeper.com/b/BN77K, an anonymous mutable paste host that is fetched via axios.get;...

MAL-2026-6148 Malicious code in async-protobuf-av (npm)

The npm package async-protobuf-av published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6178 Malicious code in streaming-downloads (npm)

The npm package streaming-downloads published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6145 Malicious code in accordion-animationtiming-authorization (npm)

The npm package accordion-animationtiming-authorization published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component moun...

MAL-2026-6152 Malicious code in custom-save-area-block (npm)

The npm package custom-save-area-block published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6150 Malicious code in barcodescanner-reconnect (npm)

The npm package barcodescanner-reconnect published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in @mastra/github-signals (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e263abbd9ed9975f3f8aaecfd1a780616bc3aef00238ed9ba9075b5bf4e38f37 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in req-parmas-valid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063b7e2667c434784d0b5d2ce333ea700fbc17571da3f5f4fc7d0f03ac406bd0 Package name req-parmas-valid impersonates the well-known request HTTP client description copied verbatim as 'Simplified HTTP request client.',...

Malicious code in cryptodao-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...

MAL-2026-5966 Malicious code in cryptodao-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dbe5f8614a264a8d3cdd2ecf8ecd2ad17292dbb5c5bcc25d0ae9d77eb8821df package.json declares postinstall: node recon.js, which auto-runs on npm install. recon.js lines 30-46 scrapes a curated list of credential-bearing...

MAL-2026-5929 Malicious code in backoffice-charges-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 047eb92a0e8bb401b2c205765616c9b4b715ee7cfd33d2e6ef9dc8d645b77f04 On every npm install, the preinstall lifecycle script node index.js /dev/null 2&1 silently HTTPS-POSTs a JSON payload to https://avamnrwqo7.rbmock.de...