Malicious code in @xsat10/baileys-xsat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37ba86faab85b50d9ae903ee59c78a8b52e46797b4c003448cd9851cd774939b Package is a fork of the Baileys WhatsApp Web library. Static keyword co-occurrence patterns matched on lib/Utils/generics.js ping/GET references and...

Malicious code in accounts-final-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e67b952090179c0e7ed57045bf117d0cc14ca7d832ddce2963c4f2049b66bb Requiring accounts-final-form auto-runs setup.js via process.nextTickbootstrap in index.js. setup.js selects a platform-specific asset path...

Malicious code in metrics-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...

MAL-2026-11482 Malicious code in sap-mcp-facilitator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8470f17eabef0f8e78467a643e0bcd4598174a0647c241145e3a7a857156a64 lib/report.js collects the installer's developer identity — os.userInfo.username, os.hostname, and the git/GitHub email invoking gh api user/emails...

MAL-2026-11095 Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

Malicious code in txs-sdk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 591592a5e386a92265d0197e095f692b23b00aabfd23f20bd4d29f156cd7c21a Package [email protected] could not be fully characterized: automated code tracing engaged with the package contents but the resulting output was...

Malicious code in sixbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91338e6d735e538b7defb669e5b213cad127a9fd64290fa32d83bb855dcf9bd sixbails is a WhatsApp Web library Baileys-family fork. On every socket creation — the package's primary documented API — a 5-second timer fires...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

Malicious code in caldryn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c9be7dd8b0d1fe026c48f500d432db06ebfb7bbb0721e3b1426cd29940fd1e No a static rule matches and no traced behavioral findings were produced for this package version. There is no observed evidence of install-time or...

MAL-2026-10857 Malicious code in @gocortexio/npmgremlinbox-typosquat-moment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19008091c460cf10b254f3077108bad3b1c5289e85ae59ba7b873aff7d96866d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sixseven8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec482cba13f20090fc306d9a8c732ec4edbc8bb9326324f7dedfb544ad0d9a11 The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

Malicious code in nottuff26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d6f3663bcc4d41d4ec7b7e07a43f82567efbbab2cfb098d7227f0f0803e7577 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45385ab2d7ac9fcd5f37a9faa2824beba492422d1783deef1b9b153eda2e25d2 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-6953 Malicious code in whs4_pnm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47d72187d8b59a9a40cb8397d064bc7319b20e19ee7d48b870432bd96952b089 The package declares a postinstall script node index.js that runs unconditionally on npm install. The script POSTs the absolute filename path which...

PYSEC-2026-1986 Transformers's Improper Input Validation vulnerability can be exploited through username injection

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

Malicious code in hook-augmenting-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fbb17d535ecc8b30b2ab54a487691ec2e427f9dbc3c0e20acad414bb25f3203 Analysis of this package version produced no static or behavioral findings indicating installer-side harm. No exfiltration, install-time code fetch,...

MAL-2026-7429 Malicious code in treactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-6903 Malicious code in windrule-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12204dba8f73baf0bb7f6ce1ebd80bb2ce689752abaea290e1429aed4037bb9c No suspicious behaviors were observed in this package version. There are no lifecycle scripts fetching or executing remote code, no hardcoded...

MAL-2026-6860 Malicious code in peptideenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 002d83b1d5fb6ee781bb44fa84180c4554f5395e6b6d1226f5ac488cc18a2a28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6814 Malicious code in devkit-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 581ed217608ccad453288981a19091bbc57aac7b6dda9aa2b682485cc68c5008 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...