Malicious code in schoollesson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c019b72671bb34207fbc587803e391f42f2fd3148c3ac941d9a8cfc8468a7e8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmosclasswork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d435d8cefda2b58ca65ad06ffac8521a26ccb991dd4828dd479e64ddb38bb865 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tungtunggod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cfc083fc4a77544ba957b1c1d771998929fc71453f905f6d9c474e2bd3fb51f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tungtungisgoated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d649ce9c915a5834ac0743a8f47377d31c293de34fbe40581c2f7ce3ca56c8da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in whatsgoodlookingbabycreed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e598067256b5fe5407b1f8b201925a118b6a08ea19be59cc80db3c60082fe19b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in lil-swisgom-hlepers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75aeaaa8ef6f56423bf517d9ff21cfed3a682701f306103f068b948e330f03db package.json declares a dependency lil-swisgom-hlepers-core whose version specifier is a direct tarball URL on a third-party host...

MAL-2026-15689 Malicious code in lil-swisgom-hlepers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75aeaaa8ef6f56423bf517d9ff21cfed3a682701f306103f068b948e330f03db package.json declares a dependency lil-swisgom-hlepers-core whose version specifier is a direct tarball URL on a third-party host...

Malicious code in chai-as-mno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381 The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project pino, while the package.json...

Malicious code in @medisend/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the...

Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

Malicious code in openai-pr-reviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3553acd3c5abc3f71b55740c4b06b2eb278f81bb678c55211f2287a498b60b61 The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS servers, current working director...

MAL-2026-14426 Malicious code in babel-polyfill-plugin-corejs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13878d994b01607c379e26646449b7cca95099f9b2eb5be2e1f8e19aeea32eb3 The package advertises itself as a Babel core-js 2 polyfill plugin, but the shipped lib/index.js contains unrelated web3-core-subscriptions boilerpla...

Malicious code in babel-polyfill-plugin-corejs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13878d994b01607c379e26646449b7cca95099f9b2eb5be2e1f8e19aeea32eb3 The package advertises itself as a Babel core-js 2 polyfill plugin, but the shipped lib/index.js contains unrelated web3-core-subscriptions boilerpla...

Malicious code in poly-price-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which...

Malicious code in remove-bg-serverless-azure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e package.json declares preinstall: node index.js, so npm install automatically runs index.js. index.js reads os.hostname, os.userInfo, the user home...

Malicious code in dim-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fefcd7c94e6eed5b5a69ce9ad5f4489c6532472ec604e6d15e5a96f63c59e51 The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's...

MAL-2026-14429 Malicious code in dim-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fefcd7c94e6eed5b5a69ce9ad5f4489c6532472ec604e6d15e5a96f63c59e51 The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's...

Malicious code in paypal-business-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 556bfd93652f806523495944dc8a441624c9a2dae4f76eadeefa9650f57091a1 The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, and walks up to 15 parent...

Malicious code in ppb-manticore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward...

Malicious code in web-advertising (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7c0c1f060691740d5149c61d74f3ddd8f6e10107c7621d700ae0819a1e2237 [email protected] declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install. The script collects...