MAL-2026-17579 Malicious code in with-cte (npm)

[email protected] contains no functional code: its only behaviour is a preinstall script that runs node index.js on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends the...

MAL-2026-16378 Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

MAL-2026-13742 Malicious code in zeal-rq-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164 The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname, os.userInfo, process.platform,...