Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

Malicious code in eth-react-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387 The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main...

MAL-2026-14287 Malicious code in @wizloft/harness-kernel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d73d94752604c9b48dd785c20cee875e268bb52c673bf3817f95000830fa85 dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints eth.drpc.org,...

Malicious code in @wizloft/harness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of...

MAL-2026-14285 Malicious code in @wizloft/harness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of...

MAL-2026-14286 Malicious code in @wizloft/harness-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554 dist/index.js the package's declared main contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. ...

Malicious code in node_cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e10a704c94a9f7a4f6344a67e3867cd87b21be574e81bbdccdc6b5ca48f65a2 The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging callers to pass cryptographic or wallet material to i...

MAL-2026-14265 Malicious code in easydsbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688 package.json declares "postinstall": "sudo node install.js", escalating to root on npm install. install.js is heavily obfuscated obfuscator.io: rotat...

MAL-2026-14257 Malicious code in modsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494 The package presents itself as a pino-like logger/middleware README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json...

Malicious code in modsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494 The package presents itself as a pino-like logger/middleware README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json...

Malicious code in api-rs-tuils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e65df9ad10889610f658c482041bdcf8c06d3c147da5cec709f246a1fa363c4 [email protected] runs a malicious postinstall hook node test.js that executes obfuscated code in index.js against the installer's machine. The code...

MAL-2026-14259 Malicious code in ranux-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f package.json declares the dependency @whiskeysockets/baileys but resolves it from github:rcedubot/X instead of the npm registry. Installing ranux-dev...

Malicious code in ranux-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23 The package main index.js is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded...

Malicious code in ranux-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2 package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarball ships a multi-tenant...

Malicious code in secp256k1-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a Package name mimics the widely used secp256k1 cryptography library but contains no cryptographic functionality. The declared main index.js is a singl...

MAL-2026-14255 Malicious code in secp256k1-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a Package name mimics the widely used secp256k1 cryptography library but contains no cryptographic functionality. The declared main index.js is a singl...

MAL-2026-14242 Malicious code in electro-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7c16137bdd5ac7c97d450fb8ff77103d9c6421f78848b1017f84348c6ec3762 [email protected] presents itself as 'Session utilities' 170-byte README but ships 1MB of heavily obfuscated JavaScript under dist/ index.js,...

MAL-2026-14246 Malicious code in hardhat-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e The package's main entry index.js unconditionally requires./lib/config, which is a 4MB obfuscator.io-style blob string array of 23,981 entries with a...

Malicious code in hardhat-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e The package's main entry index.js unconditionally requires./lib/config, which is a 4MB obfuscator.io-style blob string array of 23,981 entries with a...

Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...