MAL-2026-10127 Malicious code in eth-react-redirection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbd414dae34760c2eda09d2093a62a14d694f759350676e88229319a16594e78 On require, index.js calls callCallerAsOrigin which spawns lib/caller.js as a detached, stdio-ignored child process spawnprocess.execPath, script,...

Malicious code in validator-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a95b09ecd097cf7db1496950d26195169adb7ad2d8065a3458771389094be4 Package name validator-string impersonates the widely-used npm package validator and copies its README, homepage, and API surface. package.json...

MAL-2026-10109 Malicious code in validator-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a95b09ecd097cf7db1496950d26195169adb7ad2d8065a3458771389094be4 Package name validator-string impersonates the widely-used npm package validator and copies its README, homepage, and API surface. package.json...

Malicious code in @andrewstory18/is-real-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a6faaf0fbf39ed9ec8797c97cb8b2486be8b84eb46bfeabc3412a3eeded4aa1 @andrewstory18/is-real-odd impersonates the widely-used is-odd package by copying its README, author, and repository metadata verbatim, but ships an...

MAL-2026-10093 Malicious code in @andrewstory18/is-real-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a6faaf0fbf39ed9ec8797c97cb8b2486be8b84eb46bfeabc3412a3eeded4aa1 @andrewstory18/is-real-odd impersonates the widely-used is-odd package by copying its README, author, and repository metadata verbatim, but ships an...

Malicious code in lovable-tager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f100c9dbac6f2e352e559d0eb06f573e971845cc083b80c61f211013e03973a lovable-tager is a single-character-deletion typosquat of the legitimate Vite plugin lovable-tagger. The ESM entry dist/index.js referenced by main...

MAL-2026-10088 Malicious code in lovable-tager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f100c9dbac6f2e352e559d0eb06f573e971845cc083b80c61f211013e03973a lovable-tager is a single-character-deletion typosquat of the legitimate Vite plugin lovable-tagger. The ESM entry dist/index.js referenced by main...

Malicious code in cookie-js-ease (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d [email protected] impersonates the popular js-cookie library same repository URL, banner comment, API surface, and reused upstream author name...

Malicious code in multer-orm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb45c09aa7a237b2b9ff18ccf6426b76a4f46e5ea665c7747f35a345940e161 multer-orm is a typosquat of the widely used multer middleware. Its README is copied from multer, but the package adds a load-time dropper in...

Malicious code in express-router-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49091d8e8923e3e709cebd14f01ee1617267bf3f9b6be99052603715b7cf9f70 The sole shipped file index.js is a heavily obfuscated RC4 + base64 string-array, 337-entry rotated array, control-flow flattening IIFE that executes...

MAL-2026-10079 Malicious code in vybscan-testbed-obfuscated-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9aee5b150e0606b1c5c2469fdab43496965a3dd5664df288d68d618e326567 package.json declares a postinstall lifecycle script that runs node -e "evalBuffer.from'','base64'.toString". Installing the package triggers executi...

Malicious code in vybscan-testbed-obfuscated-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9aee5b150e0606b1c5c2469fdab43496965a3dd5664df288d68d618e326567 package.json declares a postinstall lifecycle script that runs node -e "evalBuffer.from'','base64'.toString". Installing the package triggers executi...

MAL-2026-10049 Malicious code in chai-await-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js...

MAL-2026-10047 Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

Malicious code in testudo-pack (npm)

The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...

MAL-2026-10075 Malicious code in testudo-pack (npm)

The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...

MAL-2026-10074 Malicious code in testis-pack (npm)

The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...

Malicious code in @vite-js/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 476576198de86a58304788ac79ac3c8ca21b5029d9e824e3ffab41f539146c3b Package @vite-js/ui impersonates the official vite package: package.json declares author 'Evan You', homepage 'https://vitejs.dev', ships an unmodifi...

MAL-2026-7021 Malicious code in @vite-js/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 476576198de86a58304788ac79ac3c8ca21b5029d9e824e3ffab41f539146c3b Package @vite-js/ui impersonates the official vite package: package.json declares author 'Evan You', homepage 'https://vitejs.dev', ships an unmodifi...

Malicious code in configration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3255dd4ea4a24b3e000f6a8aadb9a022bc9aed07507124a595dd42ef0b429d6e The package impersonates the pino logger README badges, module.exports.pino = middleware under a one-character-omission name configration vs...