MAL-2026-13676 Malicious code in svelte-cache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...

Malicious code in svelte-cache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...

Malicious code in @depup/memfs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 267188642a5aa8db495698be0d44bd4fed45e0e247572d44da6b76e3d1b72a5e This package is an automated 'DepUp' republish of memfs whose lib/index.js and lib/index.d.ts have been stripped of the upstream source and rewritten...

Malicious code in @depup/astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7c6330072ae71974da0dd2e0e72a33334a35b78ec5679536d95b9f205032225 This package is published under the @depup scope but sets author to 'withastro' and repository to github.com/withastro/astro, framing itself as a...

MAL-2026-13668 Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

MAL-2026-13614 Malicious code in aclade-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported...

Malicious code in ts-utility-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75e338acac1218e74bb44a4141ac9eb195da36f48eef6f4b1d11c84fe92a96ef The package's default export getPlugin performs an HTTPS request to a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/109 and passes...

MAL-2026-13617 Malicious code in ts-utility-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75e338acac1218e74bb44a4141ac9eb195da36f48eef6f4b1d11c84fe92a96ef The package's default export getPlugin performs an HTTPS request to a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/109 and passes...

MAL-2026-13616 Malicious code in hardhat-cap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8 The package is published as hardhat-cap but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger,...

Malicious Package

Overview transform-es2015-unicode-regex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

MAL-2026-13557 Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

MAL-2026-13540 Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints...

MAL-2026-13555 Malicious code in dolyame-ui-cardlogo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via...

MAL-2026-13531 Malicious code in damir-cbr-dawdntrnssbf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f On require of the package, polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts...

Malicious code in dolyame-ui-mediainfohoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers...

MAL-2026-13568 Malicious code in dolyame-ui-eventoutside (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d57db31d52ade4e7de9ebb32a078ab75bf12fb7d40cdfb0caf987e5ef62229a On require of dolyame-ui-eventoutside, bootstrap.js selects a platform-specific URL, downloads a binary from string-split-obfuscated Cloudflare Worke...

MAL-2026-13521 Malicious code in @rbxst/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e349df2092cb3672698c00cefa5268881f21a60d1f71394c9e223b40d086d2 scripts/postinstall.js runs at npm install time. On Windows it downloads a ZIP archive from https://files.catbox.moe/rp8idk.zip anonymous file-hostin...