MAL-2026-14172 Malicious code in commandor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75d139bce34f1d3290c34bb6da1c421bb579afb93672b44909ed0725eb70be3c The postinstall script in [email protected] scripts/postinstall.js XOR-decodes a hardcoded URL using key 'stf2026' that resolves to...

Malicious code in comander-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19734d8bfb929b0c1049b6220271fabaa91603506cdcb6424e67988519da9a6e [email protected] is a typosquat of commander with an empty index.js and no native sources. Its scripts/postinstall.js runs automatically on npm...

Malicious code in axois-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885 axois-http is a typosquat of axios index.js exports an empty object. Its scripts/postinstall.js unconditionally POSTs a JSON body containing a...

Malicious code in loadashjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f2ee2a45d09f0e66b8c9c6c4b3f2d19d39af009f71abffba1032b185fc4981 loadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically ...

Malicious code in ladash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js,...

MAL-2026-14178 Malicious code in ladash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js,...

MAL-2026-14174 Malicious code in commandorjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b [email protected] is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js,...

MAL-2026-14164 Malicious code in bqq1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8709cb6f826b8ee95c1d8aef1bb12c769c165260483b6a95be782af9dbeb2ba The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On...

Malicious code in bqq1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8709cb6f826b8ee95c1d8aef1bb12c769c165260483b6a95be782af9dbeb2ba The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On...

Malicious code in pump-segments-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838470d6049e677964786698e4a7a5dca5897ce2623d54a4c3e84510381e74e5 package.json declares a postinstall hook that runs index.js on install. The script collects the installer's hostname, full process.env, platform info...

Malicious code in comander-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626 comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All...

MAL-2026-14170 Malicious code in comander-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626 comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All...

Malicious code in lodahsjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318 Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it...

Malicious code in mutex-thread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097 The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes...

Malicious code in @library-dev-team/data-sanitizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec70432fa5463156a41cb4031ccdd89aa76b724eaac0c6e8e61949cb18403d02 The package's main entrypoint runs an unconditional IIFE at require time that reads .env from the current working directory and extracts values label...

Malicious code in typscript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945 typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte...

MAL-2026-14157 Malicious code in typscript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945 typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte...

Malicious code in typscript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1425e6f0bb2305eeddecaab5403e09ead0e8f60b9b1f817581a343cb5a3dd062 typscript-cli is a typosquat of 'typescript' index.js exports an empty object; no library functionality. Its scripts/postinstall.js is the only...

MAL-2026-14156 Malicious code in typscript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1425e6f0bb2305eeddecaab5403e09ead0e8f60b9b1f817581a343cb5a3dd062 typscript-cli is a typosquat of 'typescript' index.js exports an empty object; no library functionality. Its scripts/postinstall.js is the only...

MAL-2026-14154 Malicious code in typesript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac32bb6c3db806740bda125cf58a8f348256baa021b0a6c7b901ebb86720505 Package name is a one-character typosquat of the widely-used 'typescript' family. On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a...