MAL-2026-15183 Malicious code in classlink-yo9y3rsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f57b285c68a12fe4c8abd89d685c5b26f4fc933e56d8e4a0c643ec7969110ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-12022 Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

MAL-2026-11506 Malicious code in beaver-ui-date-range-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 744905f86e776fde6075a23e40274b0d4798bbb835114506926e0799430c24ba [email protected] declares a postinstall hook node setup.js and additionally triggers the same script from index.js via try...

Malicious code in test-dev-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6205523817ec8f05eccf82a334fa70429c8c326b73c27e031fe991b9abdbdb The package exposes handlers that receive messages over a network connection and dispatch them to shell execution, arbitrary-path file exfiltration,...

Malicious code in routerbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f468779704fb38dd80ed26eabb01f4afdfef486ebb645d99fc07c36dcb479cf The package published as 'routerbase-mcp' declares a bin named 'install-email-research' and ships lib/report.js which collects the installer's email...

MAL-2026-11486 Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...

Malicious code in ethe.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab166dc6e7cba65e133a48f30493d785512b96592dd9e86b960621ec2125cfcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-bubble (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 956b35c3b022736d505e63ff195d09af3bfe315d35774c9544de2e3569affab8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lodash-ex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ddc129136b388cfe448e3253a312b7a54ddc90993e77f4e91fd859b08fbb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11287 Malicious code in ecto-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22c8d3b7c34470a9fc4d565d8acfaea51246e1a4a88ca0136679fd6390af63e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11412 Malicious code in zcas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5d5014de4102b1c6d4a4f5b01f55b1dda65bf7585bbb6adf3d89bce7967964c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @relforce-dev/console-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdf30366d8098d04f78ab20d628d2e82537efc7c80f07c9d89db861a343a57f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11343 Malicious code in page_colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4263830f03bdc8ee0efe3cb0a419db9752ddf2c3f056b17182d1c8ba2b1f62ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11252 Malicious code in build-time-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware feae498c1a766e86bf16277cb25155aebc829bba8df487a86f88e7e66c1caf64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gatorhelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54f5990a3f959ce168ab7ece44797a63a5a61024f2783572d773da2381b47e88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11207 Malicious code in @404c3s4r/testxxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bd0eb9a43f893d498f074432357cace7974802e77750075976412a8300599a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11193 Malicious code in litespeed-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3af61c30e0a85b26bb59e521eb02a26c0b7071446d99d03cdf6b07f790b1f8 This npm package a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module ships a preinstall script and a top-level...

MAL-2026-11098 Malicious code in crm-reportinsightserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed758e4154bc29bda7b5ee78165766980d88068090a9853a2243509d97c11152 [email protected] executes a preinstall script index.js that collects installer host identifiers — os.hostname, os.platform, os.arc...

Malicious code in txs-sdk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 591592a5e386a92265d0197e095f692b23b00aabfd23f20bd4d29f156cd7c21a Package [email protected] could not be fully characterized: automated code tracing engaged with the package contents but the resulting output was...

MAL-2026-11073 Malicious code in @fazzcode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f1bff90cd31ad87a8cd76716c0c7fb23b148c5fa1d4ac226ce3ea10ebf70835 @fazzcode/baileys is a fork of @whiskeysockets/baileys that re-exports the upstream makeWASocket API while injecting an undocumented remote-controlle...