MAL-2026-14143 Malicious code in tyepescript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a867a5fc578cb6dcb759370e837d1a4c7e24f6db63c0c0f781e2c24995905e6 tyepescript-cli is a typosquat of typescript. Its scripts/postinstall.js XOR-decodes key stf2026 a set of obfuscated byte arrays that resolve to an...

MAL-2026-13867 Malicious code in @years18/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bf341a3d4e6a362dbd4b46fa8ecbd4b612a10766846ab46662e8b076f69a8ab This package presents itself as an n8n workflow helper but ships a near-empty node stub nodes/PwnNode.node.js, 213 bytes while its postinstall hook a...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

Malicious code in @coralxyz/anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763 Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor hyphen removed. The npm postinstall hook,...

Malicious code in @cryptosrvc/shift-exchange-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ff6c468a083fe963c94caf5edbd3b36e83ba753c9c2d14c807f6a4bb3b6048a On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, SUDOUSER, home directory,...

MAL-2026-12092 Malicious code in @wethenorth12/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8 @wethenorth12/[email protected] is a typosquat of the ethers package package name, description, and author string 'ricmoo' all mimic the real package;...

CVE-2026-46412

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

CVE-2026-46412

CVE-2026-46412 affects @beproduct/nestjs-auth versions 0.1.2–0.1.19. An attacker published malicious builds via a compromised npm publish token, deploying a Mini Shai-Hulud worm payload. The postinstall script harvested secrets (npm tokens from ~/.npmrc, GitHub PATs and OAuth tokens, Actions OIDC...

Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in twilio-deploy (npm)

The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

Malicious code in twilio-platform-request (npm)

The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a private...

MAL-2026-10934 Malicious code in twilio-internal (npm)

The twilio-internal package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against ...

MAL-2026-10938 Malicious code in twiliointernal-messaging-toolbox (npm)

The twiliointernal-messaging-toolbox package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10931 Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10936 Malicious code in twilio-platform-request (npm)

The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a private...

Malicious code in twiliointernal-messaging-toolbox (npm)

The twiliointernal-messaging-toolbox package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10935 Malicious code in twilio-platform-async-data-fetch (npm)

The twilio-platform-async-data-fetch package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in @andrewstory18/is-real-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a6faaf0fbf39ed9ec8797c97cb8b2486be8b84eb46bfeabc3412a3eeded4aa1 @andrewstory18/is-real-odd impersonates the widely-used is-odd package by copying its README, author, and repository metadata verbatim, but ships an...

Malicious code in @wagni_bot/eth (npm)

The npm package @wagnibot/eth is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...