MAL-2026-14006 Malicious code in priority-mutex-lane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd0cb794e1b53c6b4c63bdd456196771029c0c003a33694581dadd3707acf0e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ai-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...

MAL-2026-13964 Malicious code in bs58-15 (npm)

npm/bs58-15 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-15x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-15x as a runtime dependency declar...

MAL-2026-13845 Malicious code in yangming708 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f670e6c07175c9534c5554cc89c44a73a22d46a18a9a19140030b5b446fba17f The tarball contains only package.json and index.html. package.json declares main: "index.html", which is not a requirable Node module, and no...

MAL-2026-13807 Malicious code in fdhcvriwecv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72894ed6ed82e4ebcbd83619b2a3f591c7dab355050fc1d43a62f90d384ee08 The tarball contains only package.json and index.html. package.json declares main as index.html, and there are no...

MAL-2026-13793 Malicious code in cjdfswifuem3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 565ffd2f5127412df02a03f80345ff2420dc5545b65abff5298eac3bf1bf2990 The package has no JavaScript module; package.json declares main as index.html, which cannot be require'd, so installing or importing this package...

MAL-2026-13829 Malicious code in nhdxzthponv5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6436b46b4e05feabab19a551bd470495e4d8fc9dfef7e42a01bd527054b1b07d Package [email protected] has a random name, no description/author/repo/dependencies/lifecycle scripts, and its 'main' points at index.html with...

MAL-2026-13813 Malicious code in hgdvfuflnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfc8e3c1c86c0f0589e1ab4d2a6e3f3a757b758c1f126e0d197f3924d9637922 Package [email protected] contains a single file, index.html, declared as the package main. The HTML impersonates a Cloudflare 'Just a moment...'...

Malicious Package

Overview joule-sbx-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2284b9966871244eb99dd61230f6b17e6b2fb315484fb2b3048c51a780820a1f The package's postinstall script POSTs installer metadata package name/version, platform, arch, Node version, timestamp over plain HTTP to a hardcode...

MAL-2026-13744 Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2284b9966871244eb99dd61230f6b17e6b2fb315484fb2b3048c51a780820a1f The package's postinstall script POSTs installer metadata package name/version, platform, arch, Node version, timestamp over plain HTTP to a hardcode...

MAL-2026-13749 Malicious code in base65-33x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e22e29bf42b32b80c5336d5f38d10d96879c84f162d86565289b588253589b Package name resembles the popular base-x encoder/decoder. The exported decodestring function in both CJS and ESM entrypoints POSTs its caller-suppli...

MAL-2026-13767 Malicious code in sui-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11a215fced265f75473130d499c7d6ea6097f63aa19c595fc5445a56633b1c6e On require'sui-bcs-codec', a hidden IIFE labeled 'compat-probe' in index.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, and.env files under cwd...

MAL-2026-13738 Malicious code in @openzeppelin-5/contracts (npm)

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v5 line via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

MAL-2026-13732 Malicious code in joule-btp-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91439e7a69d936aa8a65b16561f48e9d9abab26fc8e3af4087da8d367cfd2210 On pip install, setup.py runs a collectandexfiltrate routine that reads /private/etc/passwd, /private/etc/hosts, and /private/etc/sudoers; captures...

Malicious code in dlmm-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ddf2d03d839f7eff709e78da1d6a85226cdd3b9171dbcb59a4a95c741e0773e The package's top-level module runs a report routine on import, and setup.py invokes the same import at install time. The routine collects environmen...

Malicious code in upshift-finance (npm)

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...

Malicious code in @aerodrome-finance/slipstream (npm)

@aerodrome-finance/slipstream is a malicious npm package that impersonates Aerodrome Finance's Slipstream concentrated-liquidity AMM. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall ru...

MAL-2026-13776 Malicious code in upshift-config (npm)

upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk. The version 0.5.14 is fabricated to imply a release history the package does not have it is a first-ever publish. Its body is byte-identical to augustdigital-s...

MAL-2026-13739 Malicious code in ethereum-vault-connector (npm)

ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector EVC protocol. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js |...