MAL-2026-13380 Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

MAL-2026-13342 Malicious code in encrypt-string-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e index.js is heavily obfuscated with obfuscator.io rotated base64 string array + decoder wrapper. All exported APIs loadEncryptString,...

MAL-2026-13209 Malicious code in @guangnao/claude-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9276dba65fd393d94c5beb06122b1297994c96bda03d940f34fcc59016e4c5b The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespoke base64+XOR decoder functi...

Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts...

MAL-2026-12851 Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

MAL-2026-12510 Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

Malicious code in pfa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...

MAL-2026-12331 Malicious code in @wololasod/tiny-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 string-array VM that, on...

Malicious code in streak-math-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...

MAL-2026-12469 Malicious code in streak-math-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...

Malicious code in @zahlen/checkout-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45fa3b05e748470cdc08e19b2e86efb8a34c85f155e5972c1b0c0598c150a0bd The package's fesm2022 ESM entry declared as module in package.json and executed on import of the library ends with a trailing evalatob'...' payload...

MAL-2026-12333 Malicious code in @zahlen/checkout-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097440ff1155e4d840568cf0fc8502c00d43249340f0f301167a859fd34c9fe8 The package's main module contains a top-level block that runs on every require/import. It uses unicode-escape obfuscation \uXXXX to hide imports of...

MAL-2026-12213 Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts...

MAL-2026-12219 Malicious code in tailwind-animationgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...

MAL-2026-12234 Malicious code in tinkoff-boxy-mobile-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0975c5e634ca65495f0ec35088db60ae98702849f5f2fb31e2ad1d8eee2068b7 On require of the package, index.js loads./platform.js, which selects a per-platform payload path, fetches an unsigned binary over HTTPS from...

Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

MAL-2026-12244 Malicious code in tinkoff-mutual-mgm-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84bc64dc52d6f64a0673f548b3201cc6eed96ea71665ccd1fc1a41b29ac12cca On require'tinkoff-mutual-mgm-form', index.js loads compat.js, which selects a platform-specific asset path and fetches a native binary over HTTPS fr...