MAL-2026-14223 Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...

MAL-2026-14224 Malicious code in streak-metric-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77 [email protected] ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs...

MAL-2026-14209 Malicious code in sui-gql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33 On require, lib/telemetry.js runs a top-level IIFE that reads the installer's /.gitconfig, extracts the configured email addresses and user name,...

Malicious code in sui-gql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33 On require, lib/telemetry.js runs a top-level IIFE that reads the installer's /.gitconfig, extracts the configured email addresses and user name,...

MAL-2026-14210 Malicious code in sui-graphql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba4994f544d3df11fa82980f25dc29e379f25a3e03fdbf9a448e995a75ac76a7 On require'sui-graphql-rpc', index.js loads lib/telemetry.js which reads /.gitconfig from the installer's home directory, extracts the developer's...

MAL-2026-14216 Malicious code in timed-assess (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d39931b57405563b5114ee92146f85eeeddbeb0e235dae9f483c2b30764f47e package.json declares postinstall: node apps, which loads apps/index.js. The script reads a bundled file, decrypts it with hardcoded DES key...

MAL-2026-14214 Malicious code in sysc1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json main is index.js which invoke...

MAL-2026-14215 Malicious code in sysdo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33 The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers globa...

Malicious code in sysdo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33 The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers globa...

MAL-2026-14213 Malicious code in syjoy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529 The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload pointer.py that harvests user data across...

Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

MAL-2026-14212 Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

Malicious code in sw-pluginer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06 sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config vi...

Malicious code in eth-batcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599 index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a 149 KB obfuscated Function... payload concatenated onto the module.expor...

MAL-2026-14207 Malicious code in @sarex-team/viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5 The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded...

Malicious code in @sarex-team/viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5 The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded...

Malicious code in @sarex-team/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7 @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install via package.json scripts.install = node index.js and on...

MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...

Malicious code in @sarex-team/sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...

MAL-2026-14200 Malicious code in chai-as-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90afdde9240783f1f869b875b7967490cf579e1bae0986861498f8c98c0d973 The package advertises itself as a logger README and type definitions copied wholesale from pinojs/pino but its exported middleware is a no-op that...