MAL-2026-10307 Malicious code in imillegal2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a225f0551d1cfdc2da755da6241bc992376b5beddd6bc0895ea816391556e985 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2025-95164 Malicious code in just_hyena_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 845f75366b7eaf663f54510d1aa20603d5fa3726fa2dfeb0847506f7aa645b43 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...