MAL-2026-10346 Malicious code in nottuff2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2505cd60f257bd1c69e2bd6ccbaa987e2045a453adb8c0e1c529c34afade95c7 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10316 Malicious code in ishowfeet14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5ea096e484eab34ce84d950ffdad898264b0bc86deff68a6a48ec857a126fb The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10310 Malicious code in imillegal5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f821da7c50910d456dfcf5a26ae1afd56a7ec95836a16f570edb014d02a6608 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10369 Malicious code in ratelimitsucks4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14055b6363b7ffa1d3f701928a081a38642b2c80182d5b744b5def44fe737737 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-5916 Malicious code in nottuff25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 238a4f56f3433bf34de372e9a26264a33e33c6bde8592ddc73594d33ab7427f0 The tarball is not a Node library. package.json declares main: sw.js with description "package" and an empty author; sw.js is a browser ServiceWorker...

MAL-2025-90746 Malicious code in statutory_hummingbird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad60a3fc7104d1c995fede0123974d01e4b7de4c817756c0ff977295c9fe3eac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in esqrandominfo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9a6685808f2c046c5baecdece592eda602ca8a35bb5b64599b684c917e02d5ea EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...