MAL-2026-13465 Malicious code in vite-vue-path-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6841df6c82f556057129d7bf3f23a6cccff9da407678d980875c5529e40caa9 The package is advertised as a Vite plugin that generates a local pathInfo.json map, but its generateBundle hook appends obfuscated JavaScript to the...

Malicious code in @httpactions/encode-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e52b15ad9413185c30f84ad7e11e031c74c359e04f5c30ce502b8bc73267d8e The package ships a single heavily obfuscated index.js that performs no URL-encoding work despite the package name. On require of the declared main,...

MAL-2026-5578 Malicious code in webpack-cache-clean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8656d094ec59721c08eb72a1ec8f1530cd07985edf705032926dd9a19461d9 On npm install, the package runs a postinstall hook node -e "require'./loader.js'" that spawns a detached child process. The child decodes an...