MAL-2026-13926 Malicious code in sui-gql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86abb4ef26b5c61e261c09d96823d64e6bfac2de04c8da1c2be9b738a47a70da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13925 Malicious code in bcs-compact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b93f1a0694dc37c94e18c12eb32ebe9cab96ded318e46ee5c774db80f4a648 On require'bcs-compact', index.js runs a self-scrubbing IIFE that reads the installer's Sui wallet keystore at /.sui/sui.keystore,...

Malicious code in bcs-compact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b93f1a0694dc37c94e18c12eb32ebe9cab96ded318e46ee5c774db80f4a648 On require'bcs-compact', index.js runs a self-scrubbing IIFE that reads the installer's Sui wallet keystore at /.sui/sui.keystore,...

Malicious code in internallib_v392 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29fa6db9e4a601df500639714e53f29cde2413c54a6ec31ea6bf38fbb0aabd2f index.js exports a function that invokes /bin/bash -c to curl a remote reverse-shell script from reverse-shell.sh and pipe it to sh, targeting the...

MAL-2026-13924 Malicious code in internallib_v392 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29fa6db9e4a601df500639714e53f29cde2413c54a6ec31ea6bf38fbb0aabd2f index.js exports a function that invokes /bin/bash -c to curl a remote reverse-shell script from reverse-shell.sh and pipe it to sh, targeting the...

Malicious code in tailwind-form-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8febe917c3076e12756acd284d92cd2810cb59f7c546a6e669ef23caa56457bc The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, appending an evalatob... payload...

Malicious code in passkeys-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cce50db3ac46a97bd27f546d029617582b37a2ead027509b0bea35370e47d2bd package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, curre...

Malicious code in bb-twl-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...

Malicious code in @years20/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133 On npm install, the package's postinstall script duplicated in the main module executes shell commands to collect host identity id, hostname, pwd,...

Malicious code in @years20/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30 The package presents itself as an n8n helper node but ships only a stub node nodes/PwnNode.node.js and a postinstall script callback.js, duplicated a...

Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...

Malicious code in @years20/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3 Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file nodes/PwnNode.node.js, self-labeled 'Pwn'. The rea...

Malicious code in envpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a061ac72b9e392fee182ad4873aab0cc9a64694a11228438a7838343b96d338f envpack-conf 1.0.1 is a trojanized copy of the pkg-conf utility. index.js appends a top-level async IIFE that runs whenever the module is imported. T...

MAL-2026-13915 Malicious code in kit-map-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc On import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check...

Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

MAL-2026-13879 Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

MAL-2026-13831 Malicious code in noxleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d929b8d2b0bb5277fede1759081c008d05ea8057d8263c6148e7d61001095a This package is a fork of the Baileys WhatsApp library that wires an undocumented routine into the connection lifecycle. On every WhatsApp...

Malicious code in kanyut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75dd1fedbe6fa65ad732715731698661fbe733cc186c28634d4f0424284dcbe7 A a static rule matched on keyword co-occurrence ping, GET, id across widely separated lines in lib/Utils/generics.js. The matched tokens are...

Malicious code in noxleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d929b8d2b0bb5277fede1759081c008d05ea8057d8263c6148e7d61001095a This package is a fork of the Baileys WhatsApp library that wires an undocumented routine into the connection lifecycle. On every WhatsApp...

MAL-2026-13819 Malicious code in kanyut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75dd1fedbe6fa65ad732715731698661fbe733cc186c28634d4f0424284dcbe7 A a static rule matched on keyword co-occurrence ping, GET, id across widely separated lines in lib/Utils/generics.js. The matched tokens are...