MAL-2026-14269 Malicious code in novel-suduko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...

Malicious code in novel-suduko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...

MAL-2026-14266 Malicious code in electron-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769 Package published as electron-sessions advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated dist/index.js...

Malicious code in electron-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769 Package published as electron-sessions advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated dist/index.js...

Malicious code in postcss-initialize-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16 [email protected] presents itself as a PostCSS plugin README, badges, and repository links reference the legitimate...

Malicious code in pump-fun-skills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5818b39f1e4fbd315379ea5b32209ab3a57edb3532a948203910b3fb74bec49e The package's postinstall script index.js auto-runs on npm install and collects a broad set of installer-side data — hostname, full process.env,...

MAL-2026-14257 Malicious code in modsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494 The package presents itself as a pino-like logger/middleware README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json...

Malicious code in ranux-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23 The package main index.js is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded...

MAL-2026-14260 Malicious code in ranux-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2 package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarball ships a multi-tenant...

MAL-2026-14254 Malicious code in saaa9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3011e5a125f4db4febea1bf6778ed69ebb11009d2a1b119a46118822f3ef6e93 The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.j...

Malicious code in saaa9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3011e5a125f4db4febea1bf6778ed69ebb11009d2a1b119a46118822f3ef6e93 The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.j...

MAL-2026-14249 Malicious code in localize-extract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265d3f1cc9dae0e1599e17054e0cebe1481224741d3c3dce5d78916feebd5da2 [email protected] executes a postinstall script that collects host identifiers os.hostname, platform, arch, node version, package name, lifecycl...

Malicious code in nice-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c88734e4d701b61fd197a942bc057f59c684d4eb9994ca0efc7136dfcf893c9 The npm package [email protected] executes probe.js from its postinstall lifecycle. On install, probe.js issues requests to cloud...

Malicious code in flydev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e8d7456b5f0f3d2d3115eed9624272036cad1316cd50ee05e4134e5fa30f8ca The package advertises itself as a generic 'Utility' but ships a purely destructive payload hidden under a deeply nested single-letter directory tree...

Malicious code in github-policy-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b8742a99002975ebaced2478673108f4f442e5ac7878651edeb8346702f132 On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, node version, package name, npm lifecycle eve...

MAL-2026-14238 Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

MAL-2026-14236 Malicious code in gaarf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3312540cdedc807029a549ffd3b49b917704323a3b664c6d71ae6849c192b9 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers os.hostname, platform, arch, Nod...

Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

Malicious code in commandor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d The package's scripts/postinstall.js runs automatically on npm install and imports childprocess alongside http.request with multiple POST call sites...

MAL-2026-14231 Malicious code in chromecast-webdriver-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c858cd5357d77c39366f7bd1cc1985a5d7012d33da45d6dc9667544b54198d6 [email protected] runs a postinstall lifecycle script that collects host metadata os.hostname, platform, arch, node version, package nam...