MAL-2026-10530 Malicious code in cbr-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7 On module load, the package's main entrypoint shells out via childprocess.exec to run cat /etc/passwd and prints the contents to stdout. This fires...

MAL-2026-10543 Malicious code in skrill-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e517423e768b0086d0579e460801e0b14cb6e6751a810b23bd9f41954d92779 Package impersonates a Paysafe/Skrill payments SDK name 'skrill-payments', class PaysafeClient, spoofed 'github.com/paysafe/skrill-payments' reposito...

MAL-2026-10544 Malicious code in skrill-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...

MAL-2026-10542 Malicious code in skrill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4219c6698feb94554982491eef6e0cc533353d46c42e4a7c8679ace1264602 Package published as 'skrill' with description 'Skrill API wrapper' and repository 'github.com/paysafe/skrill' impersonates the Skrill Paysafe paymen...

MAL-2026-10540 Malicious code in postcss-processor-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0253c4f750443ba47f0ab61347fa85a1659b847190a85757575e904966636da On require, src/index.js loads src/token-loader.js, which reads data/design-tokens.json, XOR-decodes the base64 blobs under encrypted.chunks using a...

MAL-2026-10545 Malicious code in vite-plugin-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50d2f5d3fe93de908c3da2d129b5b766a740b16a0eebf6c29c684605a9eaccf3 The CJS entrypoint dist/index.js top-level requires bytenode and loads a sibling V8 bytecode blob dist/index.jsc, then injects a hidden Model.resetor...

Malicious code in vite-plugin-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50d2f5d3fe93de908c3da2d129b5b766a740b16a0eebf6c29c684605a9eaccf3 The CJS entrypoint dist/index.js top-level requires bytenode and loads a sibling V8 bytecode blob dist/index.jsc, then injects a hidden Model.resetor...

MAL-2026-10524 Malicious code in @velkov/isows (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fee1d7d5125231d00f9c5f9afe9817b76900ca385b7d077bb4b8bcf3d9ca660 Package is published as @velkov/isows while its README, repository wevm/isows, description "Isomorphic WebSocket", and author jxom.eth impersonate th...

Malicious code in @wrenfield/abitype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1b16f2fdde2184bdcfb6f2c91f18c328dee9aa1bb111f86d3130f47c42c9e5 Package @wrenfield/abitype impersonates the well-known wevm/abitype library: it copies the upstream README verbatim links to abitype.dev, wevm.eth,...

MAL-2026-10523 Malicious code in @tabrex/bs58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f8a6402182b6dec89b04f15d70fcdd2b78d678947d49c62a3f09b11a70bf306 @tabrex/bs58 ships the verbatim README, API surface, and repository URL of the legitimate cryptocoinjs/bs58 package package.json declares repository...

MAL-2026-10525 Malicious code in @vite-mcp/vite-type (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9828d7f04091054759c65d427b8f9d7b2853a8a062f9ca261a37e0a0bbc231d0 Package @vite-mcp/[email protected] impersonates the legitimate vite package: package.json declares name '@vite-mcp/vite-type', author 'Evan You',...

MAL-2026-10528 Malicious code in @vitets/vite-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf Package is published as @vitets/vite-ts and copies the legitimate Vite project's author Evan You, README, homepage vitejs.dev, and repository...

MAL-2026-10526 Malicious code in @vite-pro/vite-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7 Package @vite-pro/vite-ui impersonates the official vite package: package.json declares author Evan You, points repository at github.com/vitejs/vite,...

MAL-2026-10548 Malicious code in @amedit/vercel-builder-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe0b29ddff65cbd65167ea905c448d928fc6da661d69df415993635bf1bd3bc When wired in as a @vercel/build-utils Builder and the exported build runs in a Vercel deployment pipeline, index.js reads the installer's...

Malicious code in @amedit/vercel-builder-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe0b29ddff65cbd65167ea905c448d928fc6da661d69df415993635bf1bd3bc When wired in as a @vercel/build-utils Builder and the exported build runs in a Vercel deployment pipeline, index.js reads the installer's...

Malicious code in @flcik/flick.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c087b34f156cf2b5ae7070222a57e2d760d68f9c4c73721c2800eb7b6bf62 @flcik/[email protected] replicates the discord.js public API surface FlickClient, GatewayIntentBits, SlashCommandBuilder, ButtonStyle, MessageFlags, th...

MAL-2026-10521 Malicious code in @flcik/flick.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c087b34f156cf2b5ae7070222a57e2d760d68f9c4c73721c2800eb7b6bf62 @flcik/[email protected] replicates the discord.js public API surface FlickClient, GatewayIntentBits, SlashCommandBuilder, ButtonStyle, MessageFlags, th...

Malicious code in flick-test-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f05e70375ac31032fb4fc3abf302d1c1122bf01504f810aa74d9fe59066d36 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10522 Malicious code in flick-test-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f05e70375ac31032fb4fc3abf302d1c1122bf01504f810aa74d9fe59066d36 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in fastify-bundler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3d824f75a77642b33c2c29524f9decca40c16a12aabe0a2528f3d90deac8720 The package's exported getPlugin function fetches JSON from https://svganchordev.net/icons/105 and passes the response's data.credits field to new...