Malicious code in lite-mater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 532663c4102d3cf7310e29ca1eb2b389c5c32c1e541da219b7c4364968f4e807 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs automatically on npm install on Windows hosts. The shipped 4444.vbs...

MAL-2026-17310 Malicious code in tailwind-forms-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' with a leading...

Malicious code in tailwind-forms-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' with a leading...

MAL-2026-16139 Malicious code in tailwind-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...

Malicious code in tailwind-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...

MAL-2026-14303 Malicious code in x6842179305 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638 Package x6842179305 ships a main entry 1.js that invokes the Function constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an...

MAL-2026-13360 Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

MAL-2026-13356 Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

Malicious code in @wololasod/tiny-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 string-array VM that, on...

MAL-2026-12330 Malicious code in @vboxdev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4b16f8f98ad89c1276884f96b2ef878d2c597356aa2194c7067d2d0bbda943f build/index.js appends an evalatob'...' block that fires when the module is required. The decoded payload queries Ethereum JSON-RPC endpoints...

Malicious code in @vboxdev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4b16f8f98ad89c1276884f96b2ef878d2c597356aa2194c7067d2d0bbda943f build/index.js appends an evalatob'...' block that fires when the module is required. The decoded payload queries Ethereum JSON-RPC endpoints...

Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

Malicious code in postcss-animate-css-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...

MAL-2026-12418 Malicious code in postcss-animate-css-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...

MAL-2026-11523 Malicious code in cache-manager (npm)

npm/cache-manager version 7.2.10 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-10626 Malicious code in @react-case/option (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beffda94b8ea554f153faaf508da7906f78d821d45d2fca7b7b61180740269 The package's main entrypoint index.js is heavily obfuscated with a string-array + RC4-style decoder that reconstructs all API names and the target U...

Malicious code in @vite-js/vui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89dd59b0cc2b2931e47b1822fa705eba41767d28ae89bce2e277254377dd9a0a Package publishes under @vite-js/vui while impersonating the official vite package: package.json sets author "Evan You", description "Native-ESM...

MAL-2026-10526 Malicious code in @vite-pro/vite-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7 Package @vite-pro/vite-ui impersonates the official vite package: package.json declares author Evan You, points repository at github.com/vitejs/vite,...