Malicious code in test12vv36 (npm)

Source: amazon-inspector 9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be [email protected] declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at...

MAL-2026-13420 Malicious code in @innocarpe/deepseek-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecff1188eb08eef1faffb2e898fe393c3311abdf5e96f041435a5ca12163dc67 The npm package's postinstall script scripts/postinstall.js requires childprocess and issues POST requests carrying environment and host identifier...

Malicious code in patchwork-os (npm)

Source: amazon-inspector 101e7bafc335a4ccaf6418355dc242911c639482ce71a8b1f22b75bbdbb8af7e The package's Gemini driver at dist/drivers/gemini/index.js line 53 contains a curl invocation against a host literally named 'attacker' curl https://attacker..., reached from an install/setup code path...