MAL-2026-12407 Malicious code in pfa-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or...

MAL-2026-12489 Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

Malicious code in streak-day-primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c4f0cfff000aa550229c0148bf96c70335e4d37048fa9f8fda3d4391ea2249b The package advertises itself as dependency-free calendar-day arithmetic, but index.mjs contains top-level code that runs on import. All sensitive...

Malicious code in streak-daybucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 799caca8e351ad8d1144b26eb0c38ffdf06afb415f63a320e6ea455968996aa0 [email protected] presents itself as a day-bucket / streak math utility but its index.mjs embeds a hex-encoded Windows PE binary leading 4D5A90...

Malicious code in github-app-sts-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9434f2e4ac17da4d2b9dff0c36ed8b3c5cc3f76882b9898b768e78ba982bbac2 The package declares a preinstall lifecycle hook that runs index.js on npm install. index.js collects host identifiers and system files os.hostname,...

MAL-2026-12366 Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...

Malicious code in async-mutex-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133 Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its...

Malicious code in afisha-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13 On require of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscated mirror hosts...

Malicious code in @offa-uwk/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2 On npm install, the package's postinstall script node index.js collects host identifiers os.hostname, os.userInfo.username, process.cwd and POSTs the...

Malicious code in bpm-foundation-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045 On require of bpm-foundation-feature-flags, index.js loads init.js which downloads a platform-specific native binary from obfuscated Cloudflare Worke...

Malicious code in test22221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53 package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTT...

MAL-2026-12361 Malicious code in deposits-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9065d908318bcb4d0db09498a3c52ab32951d889d03acf4d7c3fee12821271cf On require of the package, index.js loads./init.js, which selects a platform-specific endpoint, downloads a native executable from obfuscated...

Malicious code in fb-hr-sites--boxified-form-meetup-subcribe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07 The package's index.js exports an inert class and silently requires./platform inside a swallowed try/catch. On load, platform.js downloads a...

MAL-2026-12381 Malicious code in fb-hr-sites--boxified-form-meetup-subcribe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07 The package's index.js exports an inert class and silently requires./platform inside a swallowed try/catch. On load, platform.js downloads a...

Malicious code in tracker-radar-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1 package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, D...

Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083 On require of the package, index.js loads loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by...

Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

MAL-2026-12352 Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

Malicious code in @vboxdev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4b16f8f98ad89c1276884f96b2ef878d2c597356aa2194c7067d2d0bbda943f build/index.js appends an evalatob'...' block that fires when the module is required. The decoded payload queries Ethereum JSON-RPC endpoints...

MAL-2026-12415 Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...