Malicious code in dolyame-ui-textarea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24932ddb1e2cd6672b95aae062c330f9aec9d68ee293488d54d195fbbf0acc52 The package's main entry unconditionally requires./loader.js on load. loader.js assembles mirror hostnames from split string arrays to build a set of...

Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in checkout-format-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224 [email protected] executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js...

MAL-2026-10530 Malicious code in cbr-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7 On module load, the package's main entrypoint shells out via childprocess.exec to run cat /etc/passwd and prints the contents to stdout. This fires...

Malicious code in ts-eslint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5bbed232e0268a791ce846260ce170342eec359bf1a7e84b9514767d77803a1 The package's index.js defines run/fromstr that recursively walk process.cwd and match files named.env, env, id.json, config.json, config.toml,...