Malicious code in eth-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f051957ac6f91e8567df873978b45c0c81a170f94decbd735d329f312ff1bb On require, index.js schedules a 37-second delayed routine that reads test/fixtures/keypairs.dat, base64-decodes it into /.cache-db/.node-sync/syncd....

MAL-2026-10553 Malicious code in home-mp-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single...

MAL-2026-10550 Malicious code in better-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...

MAL-2026-10547 Malicious code in pokee-data-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b6677ea5f73a9b1fbbc0dc209ef6b5d31077f316df63eec1ba4054f60645431 The package performs credential and environment harvesting at both install time and import time. setup.py installs a PostInstall cmdclass that, durin...

MAL-2026-10544 Malicious code in skrill-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...

MAL-2026-10540 Malicious code in postcss-processor-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0253c4f750443ba47f0ab61347fa85a1659b847190a85757575e904966636da On require, src/index.js loads src/token-loader.js, which reads data/design-tokens.json, XOR-decodes the base64 blobs under encrypted.chunks using a...

MAL-2026-10520 Malicious code in fastify-bundler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3d824f75a77642b33c2c29524f9decca40c16a12aabe0a2528f3d90deac8720 The package's exported getPlugin function fetches JSON from https://svganchordev.net/icons/105 and passes the response's data.credits field to new...

Malicious code in nodemon-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1d2f1b3c8848137e0ec6a9897d6f4056102623f1139549c9dd928fcb4482e69 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in nodemon-delog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea1c5b4054d6daffaf190005db661027e29255ae20de1bb410f506de1f178532 nodemon-delog is published under a name that resembles the widely-used nodemon package and ships a verbatim copy of nodemon's source tree, README,...

Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...

MAL-2026-10498 Malicious code in eslint-angular-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a6248527167bc121cdf2c1a874adbc9d433dbe4be2aed160e8abb3eb2ca63b package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:8080/ at npm install time,...

MAL-2026-10495 Malicious code in @quukk/opencode-clawmessenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e48f1438950e47277df7d6b0df77f7e2ecf2315323b0012a293299bbb91b9c The package is a remote-controlled bridge: after the user runs opencode-clawmessenger setup and binds via QR code, the installed wrapper authenticate...

MAL-2026-10491 Malicious code in assertcoreutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e53b085bfe045b4aeabe9ad77e1066ab0883f27304197377681191c3118b780 assertcoreutils impersonates the popular chai assertion library: the README, the chai keyword, the lib/chai/ directory layout, and lib/chai.js are...

MAL-2026-10489 Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

MAL-2026-10485 Malicious code in polymarket-stake-kelly-math-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a7da439d70295bc7192ecc100ebdff0b08a601d31aa98dcf20af783ec169a26 The package declares a postinstall hook node scripts/install-check.cjs that reads a remote JSON config from...

MAL-2026-10484 Malicious code in browser-use-headless (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a85306ba70b361b2851e9e3db9219235556e964e62ad131a7c9760ff63b49b88 The package presents itself as a headless browser-automation helper typosquat of browser-use but contains an appended credential-stealer block. On...

MAL-2026-10471 Malicious code in loading-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94 Package name impersonates the pino logger exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js, lib/redaction.js,...

Malicious code in @uw010010/vite-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280687ad50e03b43bf7f26df6afb1a8fb794eb486c126b2368f37c6b76625318 The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author 'Evan You', description...

Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

MAL-2026-10458 Malicious code in compliancepolicyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9f18c11413e208ef48e083af8a065b36134c2b37b5fd1474a5701a986a659d8 [email protected] registers index.js as both scripts.install and main. On npm install and on require, index.js loads lib/core.js, which rea...