MAL-2026-14214 Malicious code in sysc1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json main is index.js which invoke...

Malicious code in sysdo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33 The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers globa...

MAL-2026-14215 Malicious code in sysdo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33 The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers globa...

MAL-2026-14213 Malicious code in syjoy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529 The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload pointer.py that harvests user data across...

Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

MAL-2026-14212 Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

Malicious code in sw-pluginer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06 sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config vi...

Malicious code in eth-batcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599 index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a 149 KB obfuscated Function... payload concatenated onto the module.expor...

Malicious code in @sarex-team/viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5 The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded...

MAL-2026-14207 Malicious code in @sarex-team/viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5 The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded...

Malicious code in @sarex-team/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7 @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install via package.json scripts.install = node index.js and on...

Malicious code in @sarex-team/sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...

MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...

MAL-2026-14200 Malicious code in chai-as-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90afdde9240783f1f869b875b7967490cf579e1bae0986861498f8c98c0d973 The package advertises itself as a logger README and type definitions copied wholesale from pinojs/pino but its exported middleware is a no-op that...

Malicious code in chai-as-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90afdde9240783f1f869b875b7967490cf579e1bae0986861498f8c98c0d973 The package advertises itself as a logger README and type definitions copied wholesale from pinojs/pino but its exported middleware is a no-op that...

Malicious code in chaikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4 The package's main entry index.js unconditionally requires./lib/config, a 4MB obfuscator.io-style file RC4 string-array decoder with 23,902 entries,...

Malicious code in tailwind-custom-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720 The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an...

MAL-2026-14195 Malicious code in tailwind-custom-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720 The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an...

Malicious code in txs-runner-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9d5d94b7f75bbe8bca33eb382bfb986e68b7f0307cad7e9626da103192f254 The package advertises itself as generating random transaction data, but its main API method getTransactions invokes loadtransactiondata, which reads...

MAL-2026-14193 Malicious code in ts-rand-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f3c43a89866228b5365b9e318da3ea953bb2c5b7da94136d887359e8e1f07a8 Package presents itself as a random transactions SDK exposing a single API, getTransactionscount. Following that documented usage triggers a hidden...