Malicious code in @devmikets/hyperliquid-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.or...

Malicious code in @demopack/www (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...

MAL-2026-14039 Malicious code in @cdnshell/loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b572368b522527a308a0a8057b3b0945ded5c73f4dcad6ab738eaa2b7ddf6e3 Package presents itself as a CDN static-asset distribution library but ships 19 pre-compiled arm64 Mach-O binaries under 03payloads/ stager, kbridge,...

Malicious code in alelo-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e The package's preinstall script preinstall.js collects hostname, username, platform, current working directory, and the full process.env, then POSTs...

Malicious code in alelo-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7ed1d4017e58a9911a0cfee5d1cf8122a2ac28779a36fdf3ef74484f048748 [email protected] ships lifecycle scripts that harvest installer data and POST it to a hardcoded bare-IP endpoint 209.99.185.109 with TLS certificate...

Malicious code in datefmt-simple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9 datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fir...

MAL-2026-14028 Malicious code in alelo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1fd03e0ca4d5452b6a5d6aa2880a9c711021e287eaae056e68f70f6aedc926 On npm install, preinstall.js collects hostname, username, platform, cwd and the full process.env and POSTs the JSON body to...

MAL-2026-14033 Malicious code in meualelo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fdf84c3f49f6d13b7ccbed745056f8bf03c4c7a2b814152962361ac07bd4191 The package's preinstall.js collects hostname, username, platform, cwd, and the full process.env, then POSTs the JSON payload over HTTPS with TLS...

Malicious code in bootstrap-custom-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b61501946d7df441ba0b302898ff5aa223b09828775504099fc8d91878d81 The package presents itself as a React/Bootstrap UI component library but its default export getPlugin performs an HTTPS request to the hardcoded...

Malicious code in alelo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898fc8ceef98678ef5e208de13006abf0684d219babdee50f6f90b732092f8b [email protected] is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace version 99.0.0, generic 'internal...

Microsoft Defender Elevation of Privilege Vulnerability

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak "...

Malicious code in heft-storybook-v6-react-tutorial-storykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5955868f72344703128add3301e3a85b51773de502f24e636fe0b9bba86d42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14075 Malicious code in ak-mal-test-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb1e00b87448788cd84d0c30aa68374d531288859498450fe6db4ab3e2d63e42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ak-mal-test-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb1e00b87448788cd84d0c30aa68374d531288859498450fe6db4ab3e2d63e42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14081 Malicious code in game_overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e941794f17bbd4170928ecfb4c2affa3b9464d9227bc5671e4899aaca4a88db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in game_overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e941794f17bbd4170928ecfb4c2affa3b9464d9227bc5671e4899aaca4a88db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pocbitbarrontest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8730ba23c54aed5d25d755bc1f2ed8809e57cb1996b80d301a5f265a3c09052 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zip-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a990db9c306a25a8b0663088429ef5cf3939c32a9f8d6b1fc3066e8bf42a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14099 Malicious code in zip-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a990db9c306a25a8b0663088429ef5cf3939c32a9f8d6b1fc3066e8bf42a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dinotech-auth-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21556f23a2332af836a6f0c905a4391a6699a2dcd8a597c9e9955caf795333f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...