MAL-2026-16193 Malicious code in strapi-plugin-yayccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de07e63ac0a0d5b02ad74abd90d075d73e80cdfcc1bbfbdfcfbe56460354735a The package's postinstall lifecycle script node postinstall.js executes a bash reverse shell that connects to the hardcoded remote endpoint...

Malicious code in noblox-asset.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d897fe6a57fc9f74c5dd46a89603da107c43ad60d3854a86987d67f5702973 noblox-asset.js impersonates the noblox.js Roblox API wrapper: package.json copies the legitimate package's description, homepage...

MAL-2026-16082 Malicious code in @umschool/platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcf64895a777467cc94763bfb942be3c04040ca151fc22753ca48ac4aaecd69c @umschool/[email protected] is published to public npm under an internal-looking scope with an implausibly high version number, a resolution shape use...

MAL-2026-14475 Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

MAL-2026-14425 Malicious code in auth-otp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script...

MAL-2026-14229 Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

Malicious code in typescriptt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 023f754538f603fbb5379ee8be82cb9524f710495e5dddc4e631e5aafbf323b5 typescriptt-cli is a typosquat of typescript-cli whose index.js is an empty module; its only real behavior is in scripts/postinstall.js. On npm...

MAL-2026-14040 Malicious code in @workoscalifant/sudoku-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath, which execFileSyncs prebuilt/linux-x64/sudoku-hint wi...

MAL-2026-13889 Malicious code in @years19/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0200e9a9dfdd3de819e8111363492aa235bd40790b89adc91a5d7e0a410ae120 The package's postinstall scripts.postinstall: node callback.js collects host identity and environment fingerprint output of id, hostname, Python...

MAL-2026-13887 Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7 The package presents itself as an n8n community node n8n-nodes-utils-helper-d but its actual on-install behavior is unrelated to workflow automation...

MAL-2026-13910 Malicious code in @years20/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60 On npm install postinstall and on require/import of the package's main entry, callback.js and index.js execute id, hostname, and WSL detection, read...

Malicious code in @years19/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44 The package's postinstall script executes callback.js, which downloads four tarballs mhddos, pyroxy-full, impacket, multidict from...

MAL-2026-13871 Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall...

MAL-2026-13851 Malicious code in @years18/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330 On npm install, this package auto-runs callback.js via a postinstall hook and repeats the same behavior in index.js on require. The script shells out...

MAL-2026-13862 Malicious code in @years18/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4bb7a1bd57477bf3cbbb1ccc9b76a2ed8b96a8117e0a4cad882b76404c86fb @years18/n8n-nodes-utils-helper-r ships a postinstall script that, on npm install, downloads a tarball from...

MAL-2026-13864 Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...

Malicious code in @ks-video/kwai-player-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189f106b356a246462f37d1199e1be9191a00724014f74d1ac2a39c94c5a8222 On npm install, the package's postinstall hook runs scripts/telemetry.js, which collects installer-side reconnaissance — os.hostname,...

Malicious code in pilgrimage-portal-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28 On npm install, the package's postinstall hook runs node ping.js, which reads the installer's hostname via require'os'.hostname and POSTs it, along...

MAL-2026-13423 Malicious code in fetchrtds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e0a6afc9e0684beee9d75d2f4966507178bed2499c8f5453629a0b827a80ef On npm install, the package's postinstall script reads a config URL defaulting to https://slimopump.vercel.app/config/clob-math.json, fetches a.tgz...

MAL-2026-13357 Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...