MAL-2026-14206 Malicious code in @sarex-team/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722e658713ad538fe6719d893d48c6bbea0c6cb84133e3a0010ef564ca6a1ec7 @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both npm install via package.json scripts.install = node index.js and on...

Malicious code in chaikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4 The package's main entry index.js unconditionally requires./lib/config, a 4MB obfuscator.io-style file RC4 string-array decoder with 23,902 entries,...

Malicious code in @ferudionz/webautomation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a55c1cc52c2e4580b15c1b9e32b436719687f489ee4ee55686aec1ec9a3adc59 The npm package @ferudionz/webautomation exposes a single function connetx whose sole behavior is to POST the caller-supplied argument to a hardcoded...

Malicious code in webautomation_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...

MAL-2026-13810 Malicious code in gdwkh6vcbu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 149331c58c86a1da87dcdde4ec9e7f780a879ca2283946418cfff31077797bd4 Package [email protected] ships a single index.html declared as main, with no JavaScript entry point, no install lifecycle hooks, and placeholder-only...

Malicious code in base65-12x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b553d84d7f4dc5347840ddb97f16738eed2e52ac9757b48d2cb31ba1af7122 The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry...

MAL-2026-13746 Malicious code in base65-12x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b553d84d7f4dc5347840ddb97f16738eed2e52ac9757b48d2cb31ba1af7122 The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry...

Malicious code in base65-11x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cc9506a804a2663d0cde1c610fa8cba5733e6797652b6365569ada5ef3901d base65-11x is a name-lookalike of the widely used base-x encoder. Both entrypoints src/cjs/index.cjs and src/esm/index.js, 127KB each vs. 4KB for rea...

MAL-2026-13701 Malicious code in chai-as-format (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c The package's index.js unconditionally requires./lib/config, which is a 4MB single-line file consisting of an obfuscator.io-style hex-encoded string...

MAL-2026-13691 Malicious code in @rblxts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0 @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names 'fs','https','childprocess',...

MAL-2026-13663 Malicious code in sme-rko-finance-front-payments-feed-display-list-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e33cae8840b73256d5d48935bfa7b8490ea7a36d56edeff8adfc4ca19dfea49 On require, index.js loads helpers.js which selects a platform-specific endpoint, downloads a binary from one of three string-concatenation-obfuscate...

MAL-2026-13627 Malicious code in @nestjs-passport/jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3060c9289c475e223c1c00bc21a0f59f8aa5b18e31bfaee6e4d923eab0042f Package published under the @nestjs-passport scope, which resembles the official @nestjs/jwt and @nestjs/passport packages. The sole entrypoint files...

Malicious code in dolyame-ui-progressline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints...

Malicious code in fast-hashes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503b750458783954b66f8dea6ee8b0300fd7db5b225280f1af432cf78c1faf6d setup.py defines a custom install command NativeInstall.run that decodes a base64 blob and passes it to execcompile... at install time. The decoded...

Malicious code in vite-vue-path-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6841df6c82f556057129d7bf3f23a6cccff9da407678d980875c5529e40caa9 The package is advertised as a Vite plugin that generates a local pathInfo.json map, but its generateBundle hook appends obfuscated JavaScript to the...

Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

MAL-2026-13405 Malicious code in vitest-preview-pro-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...

MAL-2026-13368 Malicious code in express-dever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31 [email protected] registers postinstall: node index.js in package.json, and index.js is heavily obfuscated obfuscator.io-style rotated string array...

Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

MAL-2026-13260 Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...