Malicious code in bcc-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80 [email protected] is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm...

MAL-2026-14117 Malicious code in bcc-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80 [email protected] is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm...

Malicious code in upload-to-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...

MAL-2026-14067 Malicious code in upload-to-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...

Malicious code in @workoscalifant/sudoku-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath, which execFileSyncs prebuilt/linux-x64/sudoku-hint wi...

Malicious code in alelo-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e The package's preinstall script preinstall.js collects hostname, username, platform, current working directory, and the full process.env, then POSTs...

MAL-2026-14021 Malicious code in alelo-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e The package's preinstall script preinstall.js collects hostname, username, platform, current working directory, and the full process.env, then POSTs...

Malicious code in datefmt-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall...

MAL-2026-14031 Malicious code in datefmt-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall...

MAL-2026-14032 Malicious code in datefmt-simple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9 datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fir...

Malicious code in datefmt-simple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9 datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fir...

Malicious code in alelo-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1e53c8bced61d4dfbd9121821219a5c35f2a7f273f06e9e2cfd628f509341f The package auto-executes exfiltration code during npm install via preinstall and postinstall lifecycle scripts. preinstall.js collects the hostname,...

MAL-2026-14027 Malicious code in alelo-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31cdc535ad02d3d78533315ef2037d4860699d9c7a161ed96a176082824f07 [email protected] runs both preinstall and postinstall lifecycle scripts that harvest installer data and POST it to the hardcoded bare-IP endpoin...

Malicious code in notafollower1226 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint ECSCONTAINERMETADATAURIV4/task to...

MAL-2026-14036 Malicious code in notafollower1226 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint ECSCONTAINERMETADATAURIV4/task to...

MAL-2026-14022 Malicious code in alelo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898fc8ceef98678ef5e208de13006abf0684d219babdee50f6f90b732092f8b [email protected] is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace version 99.0.0, generic 'internal...

Malicious code in notafollower122 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83409fb8c0dc76764a944064219de6a4d59d6b24413db5e36d897681f3183add package.json declares a postinstall lifecycle script that runs automatically on npm install. The script uses childprocess to query the AWS ECS...

MAL-2026-14035 Malicious code in notafollower122 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83409fb8c0dc76764a944064219de6a4d59d6b24413db5e36d897681f3183add package.json declares a postinstall lifecycle script that runs automatically on npm install. The script uses childprocess to query the AWS ECS...

Malicious code in notafollower1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c74ec5369dac32115a9f5f257f512fa0a48d2e914b1f18c5178992b0a1604f9 package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metadata via the...

MAL-2026-14034 Malicious code in notafollower1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c74ec5369dac32115a9f5f257f512fa0a48d2e914b1f18c5178992b0a1604f9 package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metadata via the...