Malicious code in @wbnr/design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd The package's preinstall lifecycle script runs automatically on npm install. It reads the installer's username from USER/USERNAME environment variabl...

pip: pip: Arbitrary file installation via malicious package indexes

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

CVE-2026-13346

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

MAL-2026-11195 Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

CVE-2026-59948

A flaw was found in Composer, a dependency manager for the PHP language. A remote attacker could exploit this vulnerability by providing a maliciously crafted package from an untrusted source. During installation or update, Composer's improper validation of package names allows it to write...

MAL-2026-11170 Malicious code in @finxsecdemo/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be118b4cf0acab2c331cc37f68a19bdbdf2ac8423ef984a1cac5c9f4d21c1e7e The postinstall.js lifecycle script unconditionally issues an HTTPS GET and a DNS resolution against a hardcoded interact.sh/OAST subdomain...

Malicious code in test2221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...

MAL-2026-11192 Malicious code in test2221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...

MAL-2026-11157 Malicious code in @mypwn/hawkeye (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc7070d4697e41f7bd953772681425e677c8ca9539144154b7abde925adef545 The OpenSSF Package Analysis project identified '@mypwn/hawkeye' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2026-11139 Malicious code in kordyn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c379ec39ec7791c9128dc4e1b82199ce29d7540a9a9984036af2ac79de38e1bf [email protected] advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities 'Early release — placeholder...

MAL-2026-11145 Malicious code in rollup-runtime-core-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199 The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node repository field points to...

MAL-2026-11158 Malicious code in blots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847ba592915f4561a16225808a93d2428bc12305dc3df0bbf5316bf5a5bd7518 package.json defines preinstall and postinstall lifecycle scripts that unconditionally run curl against a hardcoded webhook.site endpoint, transmitti...

Malicious code in blots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847ba592915f4561a16225808a93d2428bc12305dc3df0bbf5316bf5a5bd7518 package.json defines preinstall and postinstall lifecycle scripts that unconditionally run curl against a hardcoded webhook.site endpoint, transmitti...

MAL-2026-11142 Malicious code in node-array-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ce58719e0587902be3a6436f329ce631317fe3a7c322d89f9c679cd6e1a744 index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and literals. On require, the...

Malicious code in parallely (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...

MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

Malicious code in toll_free (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 517b4b730525b8edcc11052acd0ad205b63c60f9009f97531df84eea39eaca97 package.json declares both preinstall and postinstall lifecycle hooks that run curl against a hardcoded webhook.site endpoint, sending the installer'...

MAL-2026-11128 Malicious code in app-soda-layer (npm)

app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...