MAL-2026-10731 Malicious code in date-utils-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bd644fd9a59518d6f77e8d76c077ffef8a2afdc7ae2b00a6ca87299879a671 Package presents itself as a trivial date-formatting utility index.js exports a one-line ISO date helper but ships a postinstall.js that runs...

MAL-2026-10733 Malicious code in idlive-document-capture-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d428a1956dd86e85bfb6fb83cba2dea11bfc19250c1262d13a88c3bdd8ca07e0 Package name typosquats the legitimate 'idlive' family and ships no library functionality. package.json declares a preinstall lifecycle hook...

MAL-2026-10738 Malicious code in mui-option (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1c3ec117eaeedbd4c3f64c2fec97d44e115d400c7e52082b7d6cc28f7c59ec The sole shipped file index.js is heavily obfuscated with a base64+RC4 string-array decoder that hides all module names, URLs, and method identifiers...

Malicious code in discordia-telemetria (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7b7d95c58f4a5203f542a11bc6e8ea0ff4d55bf22b2db938b563f169a732265 setup.py contains a base64-encoded shell command that decodes to a curl fetch of an opaque binary from https://gaming-telemetry.com/v1/download, chmo...

MAL-2026-10701 Malicious code in discord-telemetry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 225e2e6a53c221447d09b6259d38d079c519056851186eb72405cb2904072c0b No a static rule matches or traced code paths indicate exfiltration, install-time code execution, credential theft, silent-relay, backdoor, or...

Malicious code in discord-telemetry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 225e2e6a53c221447d09b6259d38d079c519056851186eb72405cb2904072c0b No a static rule matches or traced code paths indicate exfiltration, install-time code execution, credential theft, silent-relay, backdoor, or...

MAL-2026-10699 Malicious code in http-req-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6fcf8bb9984d83b39b69d2dbe9e0e928c5eeab345a2fb05446ab0f6e5eb1a11d The OpenSSF Package Analysis project identified 'http-req-lite' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in @hibachi-xyz/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 214e1b690352ce0af70ce6a37d3b7ac4d8dec4269dc7606b7a65fbb6d4406e8b The package presents itself as 'Type definitions' for the @hibachi-xyz scope at version 99.0.0, but index.js exports an empty object and its only...

Malicious code in @hibachi-xyz/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308aa7f8a3746a346bbed305975f68d110bcf6b98815b7bf9f579e37089fd78b The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.js, executed on require,...

MAL-2026-10716 Malicious code in @hibachi-xyz/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308aa7f8a3746a346bbed305975f68d110bcf6b98815b7bf9f579e37089fd78b The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.js, executed on require,...

MAL-2026-10767 Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10690 Malicious code in qwen-asr-pvt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68e8b2f6db0443a648cdf03348c8dd9351568469f84b8d61022f1ed1da2a330e The package's pyproject.toml declares an unpinned runtime dependency on transformers4576, a lookalike of the widely used HuggingFace transformers...

MAL-2026-10688 Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

Malicious code in xyq-drama-skill (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ea591e5b995503deb15b174a37fc7af37cb5987a6c3d715d256fe0c3bfe10 setup.py registers a custom install cmdclass that, on pip install, downloads an opaque binary from...

MAL-2026-10681 Malicious code in xyq-drama-skill (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ea591e5b995503deb15b174a37fc7af37cb5987a6c3d715d256fe0c3bfe10 setup.py registers a custom install cmdclass that, on pip install, downloads an opaque binary from...

Malicious code in commonjs-assert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7fa2454998144bffed3fc1e2d73046b8414179b59fb99d3339f2658e00637f7 The package name resembles Node.js's built-in assert module. On require, index.js spawns a detached node child process against...

MAL-2026-10672 Malicious code in northstart-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns...

Malicious code in monogrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b1e012dd879b5435693fcaba708830625930df758bb32ac15058898e9244a3 Package advertises itself as a bulk-mailing / mail-server abuse toolkit homepage mntmc.rip and ships modules for bulk mail delivery func/snd/mlr/, SM...

Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

MAL-2026-10630 Malicious code in chai-as-byte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f On require of the package's main entry, index.js detaches a child process that runs lib/initializeCaller.js. That script posts the caller's entire...