MAL-2026-10456 Malicious code in @spzhongwin/skill-logger-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970980f38a6389d5b622ca41ba3b418f1538b2a38f595536c97acb934012b8b9 The package advertises itself as a skill usage/error logger but, when activated via the openclaw gatewaystart hook, opens a persistent WebSocket to a...

MAL-2025-148448 Malicious code in tailwindcss-morgan-xenon-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37e5976d20434dd4079fad08fcce891aad9b973e798c17384442b98ed929a1c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...