Malicious code in dolyame-ui-postcssconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51 On require of the package, index.js loads polyfill.js and lib/telemetry.js, both of which fetch a platform-specific binary over HTTPS from one of fou...

MAL-2026-12403 Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

MAL-2026-5916 Malicious code in nottuff25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 238a4f56f3433bf34de372e9a26264a33e33c6bde8592ddc73594d33ab7427f0 The tarball is not a Node library. package.json declares main: sw.js with description "package" and an empty author; sw.js is a browser ServiceWorker...

MAL-2025-113929 Malicious code in fauzi-klentik12-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80db6267da2e195df724056dc1f2233b2b9e8ac59c00b9ca3f7f6a5cfc569fb3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in misleading_sole_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42531bbc8399c1ceec43c4ef64390a01be34ac7528f58131cb95c19f0dd1b346 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69426 Malicious code in misleading-peach-elk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 699d8093b280fd77e9ab23f5eecb84e83982b414c10e097da67269ec65ee9110 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...