Malicious code in tinkoff-statist-browser-typed-client-mb.product.tgeofencing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471fb9b5c8d45abc59ffda97063561b4882d28109c9959c717fbcd0d9f25c00d On require of this package, index.js loads platform.js which assembles remote hostnames at runtime by concatenating fragmented string arrays to hide...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in @across-toolkit/typescript-config (npm)

The npm package @across-toolkit/typescript-config is a dependency-confusion credential stealer targeting developers of Across Protocol across.to. It masquerades as an internal ESLint/TypeScript config for the across.to toolkit and publishes an implausibly high version 99.0.0 so that a misconfigur...

Malicious code in syft-acp-uikit (npm)

The syft-acp-uikit package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10704 Malicious code in @across-toolkit/typescript-config (npm)

The npm package @across-toolkit/typescript-config is a dependency-confusion credential stealer targeting developers of Across Protocol across.to. It masquerades as an internal ESLint/TypeScript config for the across.to toolkit and publishes an implausibly high version 99.0.0 so that a misconfigur...

MAL-2026-10613 Malicious code in ethereum-lib-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58bddf420dcb894a940b62fba777628f0c3a9d31dd7fa915afaea618c1914d52 Package [email protected] impersonates the widely-used ethereumjs-util library: the package name, README badge, repository, homepage, and auth...

MAL-2026-10574 Malicious code in vite-plugin-config-paths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c7307466b955fa9b453e949ec2fda3153e5c444b906eed5e3bc88d190a33a7 Package name impersonates the widely-used vite-plugin-tsconfig-paths the package.json homepage points to the legitimate plugin's README, and the READ...

Malicious code in @wrenfield/abitype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1b16f2fdde2184bdcfb6f2c91f18c328dee9aa1bb111f86d3130f47c42c9e5 Package @wrenfield/abitype impersonates the well-known wevm/abitype library: it copies the upstream README verbatim links to abitype.dev, wevm.eth,...

Malicious code in @oliviamcdaniel12/safer-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f Package impersonates the popular safer-buffer module. On require, safer.js reads a PID from Porting-Buffer.md and, if that process is not alive, spaw...

MAL-2026-10234 Malicious code in slds-lsp-client (npm)

The slds-lsp-client package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Salesforce SLD...

MAL-2026-10109 Malicious code in validator-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a95b09ecd097cf7db1496950d26195169adb7ad2d8065a3458771389094be4 Package name validator-string impersonates the widely-used npm package validator and copies its README, homepage, and API surface. package.json...

MAL-2026-10047 Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

Malicious code in chai-as-serialized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e48e8980927471640c6573406d988d1a4361759f14a952da36c5daa1c9fd3c The package's main entry index.js spawns a detached node child process running lib/initializeCaller.js as a side effect of invoking the exported...

Malicious code in express-mongo-limit (npm)

The npm package express-mongo-limit masquerades as an Express/MongoDB payload sanitization middleware likely typosquatting express-mongo-sanitize but is a credential stealer, remote-code-execution backdoor, crypto clipboard hijacker, and screenshot spyware. It declares a postinstall: node index.j...

Malicious code in @logdna-web/styles (npm)

The @logdna-web/styles package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the @logdna-w...

MAL-2026-10225 Malicious code in @logdna-web/shared (npm)

The @logdna-web/shared package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the @logdna-w...

MAL-2026-10223 Malicious code in @flex-ng/header-component (npm)

The @flex-ng/header-component package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the...

Malicious code in layerd-unit-codec-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca65bb450fc2f4d4596fbcc2ddd81af358c2d02f94d965b18e532d8afa62ef5f The package presents itself as a CSS selector parser src/selector-parser.js re-exports postcss-selector-parser; keywords postcss/selector/parser/css,...

Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...