MAL-2026-11431 Malicious code in @0xlr/dep-confusion-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...

MAL-2026-11433 Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...

MAL-2026-11418 Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee541a67169360e2d9ac3da7d19353031dd395c5e1bbe05bb4540ccc4837fa3 The package's exported getPlugin/setPlugin functions, when invoked by a consumer, decode base64-obfuscated string constants svgValidateKey,...

Malicious code in rollup-plugin-polyfill-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26ffb29f08934ff71707ec249cb3572812636676d81be362b826ab0db54b5d1 Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExten issue an HTTP request to ...

MAL-2026-11478 Malicious code in rollup-plugin-polyfill-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26ffb29f08934ff71707ec249cb3572812636676d81be362b826ab0db54b5d1 Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExten issue an HTTP request to ...

MAL-2026-11496 Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee541a67169360e2d9ac3da7d19353031dd395c5e1bbe05bb4540ccc4837fa3 The package's exported getPlugin/setPlugin functions, when invoked by a consumer, decode base64-obfuscated string constants svgValidateKey,...

Malicious code in @peptide-packets/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdbac126c4dd058b5bbdeaf3b962acf9e6adce490c77b90545db33b97a878082 index.js in @peptide-packets/js-unimode exposes a listMods function that decodes a base64-encoded URL pointing to a GitHub gist owned by user...

MAL-2026-11447 Malicious code in @peptide-packets/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdbac126c4dd058b5bbdeaf3b962acf9e6adce490c77b90545db33b97a878082 index.js in @peptide-packets/js-unimode exposes a listMods function that decodes a base64-encoded URL pointing to a GitHub gist owned by user...

Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

MAL-2026-11212 Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

MAL-2026-11309 Malicious code in famshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25590ceaca7a7491267e3152f276e90e1d5dd7eee7f3a86bee0c2b7666c0427 No a static rule matches and no traced-code findings are available for this package version. With no concrete behavioral evidence in either signal...

Malicious code in famshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25590ceaca7a7491267e3152f276e90e1d5dd7eee7f3a86bee0c2b7666c0427 No a static rule matches and no traced-code findings are available for this package version. With no concrete behavioral evidence in either signal...

MAL-2026-11213 Malicious code in @grua/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b0588f2a4e3843bee403528cb8502b7c4207d2ce3179e51649b3951f8a8d2b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in compose-logger-stand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34de797bc2020fd52b9b36fda8513a111610612c3a50e75d8ea8a79440be4f0 [email protected] presents itself as a logger but its shipped code implements a credential-harvest and exfiltration pipeline...

MAL-2026-11267 Malicious code in compose-logger-stand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34de797bc2020fd52b9b36fda8513a111610612c3a50e75d8ea8a79440be4f0 [email protected] presents itself as a logger but its shipped code implements a credential-harvest and exfiltration pipeline...

Malicious code in svelte-metric-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76c232192bc12931cca4480eb306026c8ca4776ace0353ddb00fe7b947515b25 No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code, no credential or environmen...

MAL-2026-11388 Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

MAL-2026-11391 Malicious code in svelte-streak-metric (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc322e0a092d833331b172d9796648351685df0cc31d98f590288d859a00f77e The package contains no code paths matching supply-chain attack fingerprints: no install/postinstall lifecycle hooks fetching or executing remote...