Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

Malicious code in spoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c32e6b328bf731b6269e720e0fda2dec5264452ef04d406fde5296413424525 Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator source files...

Malicious code in svelte-kit-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b52621d72853042287f8152d66c3f465b510af17f7b16283d9ab64ee01dc13cb [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating exfiltration, install-time remote...

CVE-2026-48159

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

Malicious code in godot-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edb0e7385ab0574f7223206d79822362c142c664b0aed0ae5a00546b6bb38ef4 lang/gdscript.js appends a hostile IIFE after module.exports that runs when the module is require'd reachable via lang/loader.js and test.js. The...

Malicious code in tailwind-elements-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75f8605cff87e89b9f1a50c65fc27af278335cf414a8b4fb52ea4090e9fdd71b No malicious behavior was identified in the package contents. The package name resembles popular Tailwind-related UI libraries, which can indicate...

MAL-2026-13727 Malicious code in tailwind-elements-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75f8605cff87e89b9f1a50c65fc27af278335cf414a8b4fb52ea4090e9fdd71b No malicious behavior was identified in the package contents. The package name resembles popular Tailwind-related UI libraries, which can indicate...

Malicious code in fsbrowse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7866973ba5f2971efedd027cce57aefb5b8f27d7304de323261832c29bbd82 The package's main entry file index.js contains a legitimate Express file-server module followed by a unicode-escape-obfuscated IIFE appended after...

Malicious code in @sqlite-prime/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5b84b0145aa2612302c7153b5848582cdda2f6c88c802dfc0618cd376dd617 @sqlite-prime/[email protected] ships a verbatim copy of the well-known buffer library as its main entry index.js with a single injected top-level...

MAL-2026-13716 Malicious code in @sqlite-prime/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5b84b0145aa2612302c7153b5848582cdda2f6c88c802dfc0618cd376dd617 @sqlite-prime/[email protected] ships a verbatim copy of the well-known buffer library as its main entry index.js with a single injected top-level...

Malicious code in @sqlite-prime/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01e898636f16aeaf0f90bb35efaccc41186222d35f564d37c65dd1aaf471e03e On require/import, index.js constructs a GitHub Gist API URL https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90, owned by user...

MAL-2026-13719 Malicious code in commonjs-assertion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c3fd028dc7e2493e59a3f81bb26702030dac0a64a42d845bd23ea116352f94 Package presents itself as a chai-like assertion library. index.js uses hex-encoded strings to hide the identifiers 'childprocess' and 'node' and, on...

Malicious code in eth-library-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d64f85fbcbf82d877cbbbf470142d3c5ebabfc9ba8bca5a6f8fecfa70e02e13 No a static rule matches and no traced code findings were produced for this package version. No credential access, install-time network...

Malicious code in eth-library-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff [email protected] presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo —...

Malicious code in commonjs-assertion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c3fd028dc7e2493e59a3f81bb26702030dac0a64a42d845bd23ea116352f94 Package presents itself as a chai-like assertion library. index.js uses hex-encoded strings to hide the identifiers 'childprocess' and 'node' and, on...

MAL-2026-13720 Malicious code in eth-library-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff [email protected] presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo —...

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed,...

MAL-2026-13695 Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

CVE-2026-19351

creationtimestamp| type| source ---|---|--- 2026-08-09 12:52:41+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msnmvbvrda2j 2026-08-10 11:39:42+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mspzbq3juj2w...

Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e6f280e621703ad0ddfe97298c5a5dded61dd1b8fc877729ad0202f6a23a77 Package [email protected] shows no evidence of exfiltration, install-time remote code execution,...