MAL-2026-13747 Malicious code in base65-13x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529 [email protected] impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decodestring function in both...

Malicious code in base65-13x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529 [email protected] impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decodestring function in both...

MAL-2026-13745 Malicious code in base65-11x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cc9506a804a2663d0cde1c610fa8cba5733e6797652b6365569ada5ef3901d base65-11x is a name-lookalike of the widely used base-x encoder. Both entrypoints src/cjs/index.cjs and src/esm/index.js, 127KB each vs. 4KB for rea...

MAL-2026-13700 Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

MAL-2026-13288 Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

Malicious code in devplatform-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from...

MAL-2026-12763 Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12471 Malicious code in streak-view-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd index.mjs contains an indexCache array of base64 string chunks whose decoded bytes begin with the ELF magic and reference /lib64/ld-linux-x86-64.so.2...

Malicious code in express-middle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-sty...

MAL-2026-12408 Malicious code in pfp-block-independent-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four...

Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

MAL-2026-12224 Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

MAL-2026-12220 Malicious code in tailwind-animationpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3 src/index.js appends an obfuscated evalatob... block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and...

MAL-2026-11814 Malicious code in @servicetitan/ajax-handlers (npm)

npm/@servicetitan/ajax-handlers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-10743 Malicious code in nordpass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module.' The package.json...

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are listed below - @asyncapi/[email protected]...

MAL-2026-10546 Malicious code in viteplugiin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5afbe0fab50b9582867bb208b6cfb20080849e27d27df79711f55e2db69f66bb The npm package 'viteplugiin' impersonates '@base44/viteplugin' via a one-character insertion doubled 'i' and ships a hostile payload in dist/index.j...

MAL-2026-10539 Malicious code in postcss-animatecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adfcae16a606f0b7eccb6cd94c1d1d0b583b19021bb15d04161f3ca8855aba61 The exported PostCSS plugin factory in [email protected] contains an obfuscator.io-obfuscated payload that executes on every consumer build...

MAL-2026-10528 Malicious code in @vitets/vite-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf Package is published as @vitets/vite-ts and copies the legitimate Vite project's author Evan You, README, homepage vitejs.dev, and repository...