Malicious code in devplatform-spa-plugin-root-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...

MAL-2026-12781 Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

ROOT-APP-NPM-CVE-2025-13033 CVE-2025-13033 in nodemailer - Patched by Root

Root has patched CVE-2025-13033 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-P6GQ-J5CR-W38F GHSA-p6gq-j5cr-w38f in nodemailer - Patched by Root

Root has patched GHSA-p6gq-j5cr-w38f in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-268H-HP4C-CRQ3 GHSA-268h-hp4c-crq3 in nodemailer - Patched by Root

Root has patched GHSA-268h-hp4c-crq3 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-VVJJ-XCJG-GR5G GHSA-vvjj-xcjg-gr5g in nodemailer - Patched by Root

Root has patched GHSA-vvjj-xcjg-gr5g in the nodemailer package for Root:npm. Multiple fixed versions available...

MAL-2026-12561 Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

ROOT-APP-NPM-NSWG-ECO-434 NSWG-ECO-434 in base64-url - Patched by Root

Root has patched NSWG-ECO-434 in the base64-url package for Root:npm. Multiple fixed versions available...

MAL-2026-12797 Malicious code in multi-reqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...

Malicious code in poly-provider-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aef76fc9ad34b0c2f608bd61904deec5355ffe02b045eecf233e70e989ce0260 No a static rule matches were produced for this package version, and traced-code findings are not available in a parseable form. The package's actual...

Malicious code in tick-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint http://31.97.137.157:45000/icons/107 and passes the returned...

MAL-2026-13385 Malicious code in tick-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint http://31.97.137.157:45000/icons/107 and passes the returned...

MAL-2026-13381 Malicious code in poly-provider-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aef76fc9ad34b0c2f608bd61904deec5355ffe02b045eecf233e70e989ce0260 No a static rule matches were produced for this package version, and traced-code findings are not available in a parseable form. The package's actual...

MAL-2026-12812 Malicious code in ts-toolkit-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49d47be3f5dc16ea70755e0233f46106d3f50d1d5384a4f20c76b91463c9876c The package's main entry defines a getPlugin function that performs an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/112...

Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

MAL-2026-12510 Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

Malicious code in @sapappgyver/appgyver-descriptors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9396712a6bf4b08219d9ed2066ebf8c25a7558b988b6d9bf1c9ae57349a4741 The package declares an install lifecycle script that runs node index.js, which requires lib/core.js; the same module is the package main, so the...

MAL-2026-12507 Malicious code in @sapappgyver/appgyver-descriptors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9396712a6bf4b08219d9ed2066ebf8c25a7558b988b6d9bf1c9ae57349a4741 The package declares an install lifecycle script that runs node index.js, which requires lib/core.js; the same module is the package main, so the...

Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...