MAL-2026-10211 Malicious code in react-next-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286869faf09aec1d62b472e43a7188a1583c5cf8c999d1fb2e116f0b7f5ba8c6 The package impersonates the pino logger README/badges reference pino; module.exports.pino is the middleware while its name is react-next-vite. When ...

MAL-2026-10199 Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

MAL-2026-10196 Malicious code in jupiter-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e0901ca45da110106c60f288b0166fc51c348a44569d7e7ff22af3d19deafe On import jupitersdk, the package's top-level init.py fetches a payload over HTTPS from a public IPFS gateway...

MAL-2026-10194 Malicious code in solidity-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30501f6602a5b5b436ef5d6224ec332fa866c9e8b9da4d0de3bc69de868b1fff soliditydev/init.py contains a large base64-encoded Linux x8664 ELF binary in PAYLOADB64. On import soliditydev, the module decodes the blob, writes ...

Malicious code in awesome-ts-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc9fa6bfe010d792303258bd713e854e8c218c18762d62b864e8a350d1b473e Package advertises itself as a TypeScript/ESLint/Jest toolkit but ships no such tooling. On import, index.js - run - packProjectBundle walks the...

MAL-2026-10186 Malicious code in google-caja-bower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34339f1be6afb8a41b6dbe2f7d7c480d5a438a67ff119b235d1d98ffa2b2e4a [email protected] declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install. index.js walks the...

Malicious code in @uwr/colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91240d8fb55b7ed4730a41f3a334c633bf1a03afb649fd473cad0c0a25312847 The package's postinstall script reads the installer's machine hostname via os.hostname and performs a DNS lookup of...

Malicious code in fkext-browser-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects...

Malicious code in consumerweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance os.hostname, os.userInfo.usernam...

MAL-2026-10182 Malicious code in express-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c911dfdf99f0c6e13cb9e55883a5c2e17cca0b78d3149e38c0cafb6320ea742 The package advertises itself as Express security middleware XSS/SQLi protection, input sanitization but the middleware returned to Express is a no-o...

MAL-2026-10173 Malicious code in paysafe-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf94daa791fb670bda071f1b90b36f5b1f89dfb2ffc7eb7ccbf798fdff8915c1 The package impersonates a Paysafe Customer Vault SDK but is a credential stealer. index.js defines an exfil routine that collects os.hostname,...

MAL-2026-10174 Malicious code in type-atob (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a69dbe06ae711c652bace745ae01fe11b2472c8d3b9891b02828cab9bfa8f653 The package advertises itself as a pino-style logger exports module.exports.pino = middleware, keywords fast/logger/stream/json, pino-like file layou...

MAL-2026-10164 Malicious code in type-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d064750b4e3821d296d538ea749483e3f9cd54299645fc1c895e5c1af3639b5d The package presents itself as pino typosquat; README mirrors pino. The main entry index.js exports a middleware factory that, on invocation, spawns...

MAL-2026-10157 Malicious code in notify-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9cbb2ac45124e3844e29f3efd70ca26f0089ec4eaad718bcbdaf3035ec9b34b The package impersonates the pino logger API exports module.exports.pino = middleware, ships pino-style files such as lib/proto.js, lib/multistream.j...

MAL-2026-10140 Malicious code in @amtrav/webservice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1536781ed617d290a8d9a96fa1a1230943a7cc05957b4b56f853caa902da5856 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10146 Malicious code in ng-search-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 095a335a93f1ebe0047f2cdf56c2d52551d7c8602ade2e850486a6e19f514545 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10144 Malicious code in mdb-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24ffe7ac6e64aab50d9ba84f5b06ffd1047663698d25071770749b36afe6543 The package's default export getPlugin performs an HTTPS fetch to https://svganchordev.net/icons/107 with URL components split across protocol, domai...

MAL-2026-10147 Malicious code in polygon-gama-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e5efa9d57dae04a6082dfa776d2c2664f3ce5a838ed9cf56f40656937b7e92 polygon-gama-apis exports getPlugin, which fetches JSON from https://bet.slotgambit.com/icons/111 and passes the response field data.credits directly...

MAL-2026-10148 Malicious code in polygon-gamma-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49bd3ddb3340e0ef3c76465b6e275d45ddc8eecdbd742747acde8588a2018b4 [email protected] advertises itself as a 'TypeScript SDK for the Polymarket CLOB API' but ships no Polymarket API surface. The exported...

Malicious code in uac-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2f1cf2dbbdb87f2b0c37826d8326ff0ca7ecfdbc3af1dd4fdd31a0c299c78b [email protected] is an analytics package that, on install, silently mutates the installer's project files: postinstall.js invokes integrate which...