MAL-2026-1932 Malicious code in react-native-international-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f86d66bcbb0f2abf075d3d4ce6a18c3a8ec1563e35087a9fe409f56f9fb64a9f The package react-native-international-phone-number was found to contain malicious code. Source: ghsa-malware...

Malicious code in @upstashed/context7-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570280cb87bacfa8bbf1ce7b89fa14845c922e464e6964a22584d2e6ff2e197d The package @upstashed/context7-mcp was found to contain malicious code...

Malicious code in changelog-logger-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7df10f389f394a16d448bc3f80b0b77a100506b76590ef476e6b688e59d62d9f The package changelog-logger-utilities was found to contain malicious code. Source: ghsa-malware...

Malicious code in dazaar-cli (npm)

The package 'dazaar-cli' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...

Malicious code in react-svg-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e014ccf1aaf52a0f5ad92a977b2fb987b63be3ae7bdf8fa9b5f8813f68040344 The package react-svg-anchor was found to contain malicious code. Source: ghsa-malware d539493dcc209d4d478ffa4a5893cd5cd01ee1d994700b9492b651c8aeb372...

MAL-2026-1250 Malicious code in pear-apps-lib-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 331d2742dee8271e5d493e475aab23ee3f05adc5e02888d87127d189883cc50c The package pear-apps-lib-feedback was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1210 Malicious code in tailwindcss-forms-animation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5581b4e4ac6d5e02fe8dd2de23b1267ad2ac1b40a0c5be4cd284af8c6979588 The package tailwindcss-forms-animation was found to contain malicious code. Source: ghsa-malware...

Malicious code in @meli-lint/eslint-config-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f8e866ee1edded4e092e1ece0dac9fae771a6870cc053bcfe711d56d77b1e4 The package @meli-lint/eslint-config-base was found to contain malicious code. Source: ghsa-malware...

Malicious code in jsonupon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e934753e8b8ee104342730e5c20c02ad4724c9fdfdf889ffa8e026d141133cdc The package jsonupon was found to contain malicious code...

Malicious code in foundations-theming-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58f9a087aa35c09a66eecf85d207eecd0a562d059891388be07c1b47f566db6 The package foundations-theming-base was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192596 Malicious code in starling-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02cb3e1a7a02e3f4215b9e7e7d4f0034bd086085c49a157f37ecf151a9009610 The package starling-api was found to contain malicious code. Source: ghsa-malware a935f963069dc7da39338aa1f718ac33babb8d366d6e23c489a4515b776d6577 A...

Malicious code in node-calculator-0d96 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a218c7694e38a516577be3b65e74e782080f98629b0cc39516beab80562f57b The package node-calculator-0d96 was found to contain malicious code. Source: ghsa-malware...

Malicious code in @antstackio/json-to-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8602af1c076497f0aec4cec65fb012f2646c78c8c97f0fa8b234d5ef638fa6d The package @antstackio/json-to-graphql was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191254 Malicious code in @oku-ui/collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 881324e8071cf3faabccf492103c5280af893332c6a40845e781826209b86b0f The package @oku-ui/collection was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191338 Malicious code in @voiceflow/circleci-config-sdk-orb-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93fddfa88f30512d04aa154c955befc6e560cd4a1600f731643caf20e799e5c8 The package @voiceflow/circleci-config-sdk-orb-import was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191375 Malicious code in @voiceflow/stitches-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06695269b63d5e1d5d67fbf2ec3e8ba8a46439f10a30ca584e674ad93dbf53f1 The package @voiceflow/stitches-react was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191362 Malicious code in @voiceflow/npm-package-json-lint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcb13f449b9f8582e57b2b30103359ccd3efcbde9b172f827a481af246122211 The package @voiceflow/npm-package-json-lint-config was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191331 Malicious code in @voiceflow/alexa-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2a57c4900c522a4ebbd888c0fac2f59b4f5078a7fd20a124d4b46f6329b5161 The package @voiceflow/alexa-types was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191348 Malicious code in @voiceflow/fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae935a1a5c4c3792b0a6e51cfeca10ee5d11192e0928bf28ac3fd58ce89c24b7 The package @voiceflow/fetch was found to contain malicious code. Source: ghsa-malware 18354d00f52198c519ac2adf8360486ea1817d9cd1e577fe147eaff0d7633f...

MAL-2025-191190 Malicious code in @antstackio/json-to-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8602af1c076497f0aec4cec65fb012f2646c78c8c97f0fa8b234d5ef638fa6d The package @antstackio/json-to-graphql was found to contain malicious code. Source: google-open-source-security...