MAL-2026-11071 Malicious code in whs4_eud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5 [email protected] declares a postinstall lifecycle script node index.js that fires unconditionally on npm install. On execution, index.js POSTs...

Malicious Package

Overview -pem-misa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-index-main is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...

Malicious Package

Overview -john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious code in page-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99958415864bd2ddd266b99c59cdc35841e7efd9eff38481d69f4e740badd958 On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home directory, DNS server list,...

Malicious code in fundraiserservicepp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ee5547a9548aa8d9a79a6b9b8a8ded3a27c1164c780957ce31645c39253ec04 Package declares a preinstall lifecycle script that runs index.js on npm install. The script collects os.hostname, os.platform, and os.arch and POSTs...

NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.17...

Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...

ROOT-APP-NPM-CVE-2026-59875 CVE-2026-59875 in @rootio/tar - Patched by Root

Root has patched CVE-2026-59875 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

MAL-2026-11032 Malicious code in chai-as-stringify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77eb9f214b2dc10f13ecfd3239542bc27fb35bdd5d0a645b41b398d8a4a3965d [email protected] is a typosquat of chai-as-promised. The tarball ships lib/config/config.env, a 4MB heavily obfuscated JavaScript payload usin...

MAL-2026-11029 Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...

MAL-2026-11024 Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

MAL-2026-11026 Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11021 Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NPM: Next.js: Unbounded Server Action payload in Edge runtime

NPM: Next.js: Unbounded Server Action payload in Edge runtime vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

MAL-2026-11012 Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86481ee3f08109eeaec60a41afb7c2e8d03efd680cc5bf846bdc342ec4205205 The package advertises itself as a high-throughput bulk-mail tool and ships every one of its 50 JS files cli.js, denv.js, helpers.js, all commands/.j...

Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...