236627 matches found
Malicious code in shopify-internel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eb1d4e4e70cff6efbfec48cbf205e071c73a70003863e2293dbf7035547f560 Package name 'shopify-internel' is a one-character misspelling of 'shopify-internal' and appears to squat on the Shopify namespace. The tarball...
MAL-2026-6933 Malicious code in hook-augmenting-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fbb17d535ecc8b30b2ab54a487691ec2e427f9dbc3c0e20acad414bb25f3203 Analysis of this package version produced no static or behavioral findings indicating installer-side harm. No exfiltration, install-time code fetch,...
Malicious code in chai-chain-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1964693dd7c2bdd9ca7ae20eb441597571b1b78a689bd97648998c6442bda99 Package impersonates the pino logger exports module.exports.pino, README uses pino badge, keywords mimic pino but its actual behavior is a remote cod...
Malicious code in jsf-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a2a0bbd4939a789673bdca08866c9be58dd361df175695e7f8c1141bed4e47 On require'jsf-utils', lib/string/pathcase.js runs a top-level async IIFE that fetches a JavaScript payload from https://jsonkeeper.com/b/BPB86 and...
MAL-2026-6921 Malicious code in jsf-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a2a0bbd4939a789673bdca08866c9be58dd361df175695e7f8c1141bed4e47 On require'jsf-utils', lib/string/pathcase.js runs a top-level async IIFE that fetches a JavaScript payload from https://jsonkeeper.com/b/BPB86 and...
Malicious code in typescript-base58 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b860a9c4960f55c236ca5e14781f5dcfb60752d4367cb9aeb30762d3b023004e [email protected] is a one-line re-export of the 'base58-core' package. The README advertises 'Zero dependencies' while package.json declares a...
Malicious code in base58-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a7d188e2cd79918987f2008e93bb80ea9979d791b357f8f7cfd892321ded6c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-6915 Malicious code in @sqlite-list/createsql (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 955f0446501d4d7834ea1d6f4daf244eed7c040462485ba6dc794488f455ea9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6922 Malicious code in mcp-server-pg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d68bdfced357622e33e4608bd35ded4d8988ea6dc7da073b3a83075978815d On npm install, scripts/postinstall.js unconditionally reads a range of installer-owned identity and configuration files and POSTs a JSON payload to ...
Malicious code in zreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zircuit-vault (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7446 Malicious code in zircuit-vault (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zircuit-reporter (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7444 Malicious code in zircuit-oracle (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zircuit-oracle (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zircuit-keeper (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7443 Malicious code in zircuit-keeper (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in yreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...