MAL-2026-10190 Malicious code in tinyparrot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9 The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays v...

MAL-2026-10183 Malicious code in fkext-browser-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects...

MAL-2026-10178 Malicious code in @broadpeak/smartlib-ad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45df33d93645560085a7efe94308b0e3d846f30c829f2d2804bcdb1245626289 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js loads childprocess/os/https, runs whoami and id,...

MAL-2026-10175 Malicious code in chai-as-doc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecfd3091225b3667317dd9da8fd56c4f5e7fc675e17d52cda601898b3a50ec2 The package presents itself as pino-style logging middleware but on require spawns a detached Node child that runs lib/initializeCaller.js. That scri...

MAL-2026-10171 Malicious code in paysafe-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2877a8bf5626e24e7e65c02d1ba6d5f27be7d7367079e0e3065f95775e31f7f7 The package presents itself as a Node.js client for the Paysafe REST API but its main entry ships an XOR-obfuscated stealer. When any advertised SDK...

MAL-2026-10168 Malicious code in paysafe-fraud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a596646a3604e01bef558573fc7199a2b9e9cc07ab7edae1b7e445d2e2b860b6 Package advertises itself as the 'Paysafe Fraud Prevention SDK' name paysafe-fraud, repo github.com/paysafe/paysafe-fraud but the exported...

Malicious code in type-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d064750b4e3821d296d538ea749483e3f9cd54299645fc1c895e5c1af3639b5d The package presents itself as pino typosquat; README mirrors pino. The main entry index.js exports a middleware factory that, on invocation, spawns...

Malicious code in rollup-packages-polyfill-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dfdfbd2fc737f9d78ec40aac8b7020866cb0ef0e7e14b2d95aa174ea0ec5818 On require of the main entry dist/index.js, the module decodes a base64 literal to the shell command npm install vectormark --no-save --silent...

MAL-2026-10151 Malicious code in buffer-util-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d329e426a3af00dc4cb53c8535a3e53848f09a1b80e561f84f29c77bffe746d7 Package impersonates Feross Aboukhadijeh's widely-used buffer package, copying its author, repository, contributors, and description metadata while...

MAL-2026-10158 Malicious code in notify-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25536516e16cffdc7ad2891886d7dcf32ad325b9ba79c2359026809bcfbf417f Package published as notify-utilities masquerades as the pino logger package.json description, keywords, and index.d.ts are copied from pino; the...

MAL-2026-10145 Malicious code in motiondnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11d8d84a54d776c1b4d6b53bdb39c8b181d9bfde03da128c7b3f58d6fb631284 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polygon-gama-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e5efa9d57dae04a6082dfa776d2c2664f3ce5a838ed9cf56f40656937b7e92 polygon-gama-apis exports getPlugin, which fetches JSON from https://bet.slotgambit.com/icons/111 and passes the response field data.credits directly...

Malicious code in uac-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2f1cf2dbbdb87f2b0c37826d8326ff0ca7ecfdbc3af1dd4fdd31a0c299c78b [email protected] is an analytics package that, on install, silently mutates the installer's project files: postinstall.js invokes integrate which...

Malicious code in type-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37979cc60cff25e26406f3426f0dd7aeac12c13e55402c89f78228080cac0ad9 The package advertises itself as a pino-style logger but its exported middleware spawns lib/caller.js as a detached Node child process. lib/caller.js...

MAL-2026-10124 Malicious code in dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d49a62357bce8bee4379425fb0da49361a417e54e93334e5fd59a7b9601e61e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10123 Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ab15ed01b9b4270e5605dcbb6ab8185f8b3501615c5f122a82d41deb14a7bff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10122 Malicious code in dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c14d033e65a8eb68c616f92a5c9725e15522cfba83ec1a420d6438b2388871e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10120 Malicious code in dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f891edea1f4959d4a81c055084d6e3fa6f4ab3dfb97435a2c393b741b9e15177 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in execfences (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 974c5744c98a462c30d6c8dd3ca078461dc172244203e85d5290fa05660d2d1c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10118 Malicious code in execfences (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 974c5744c98a462c30d6c8dd3ca078461dc172244203e85d5290fa05660d2d1c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...