MAL-2026-10585 Malicious code in cheeriobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which...

Malicious code in ethers-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3959190c7c321e0d6f512b89b3c54a6399f3e6f7daecd0563ff753a6a6fed2f5 Package name typosquats the popular 'ethers' library. package.json declares a postinstall pointing at dist/index.min.js, whose sole top-level stateme...

MAL-2026-10496 Malicious code in bubblestring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d88c674968228c1d12eff609caca870ebe6d572631e15e2bdde0d0d4b7a320f9 package.json declares a postinstall hook that runs the package's only code file, index.js, on every npm install. index.js is heavily obfuscated...

MAL-2026-10493 Malicious code in insomnia-plugin-poc-m4gester-run (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e package.json declares a postinstall lifecycle hook that runs calc.exe on the installer's machine during npm install. The main entry point exports onl...

MAL-2026-10485 Malicious code in polymarket-stake-kelly-math-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a7da439d70295bc7192ecc100ebdff0b08a601d31aa98dcf20af783ec169a26 The package declares a postinstall hook node scripts/install-check.cjs that reads a remote JSON config from...

Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

MAL-2026-10400 Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

MAL-2026-10399 Malicious code in @equansservices/codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5e64d3c1e1d799f465001f52813a12ba2cf757ce9ea50c27d184b7549000dc9 @equansservices/codex is a typosquat of @openai/codex it also declares @openai/codex as a dependency to appear legitimate. Its package.json declares ...

Malicious code in auto-debug-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd31c11b5149d8dd2142c81cc066576dc799ba4dae4599a9569cb56256417ec package.json declares a postinstall hook node install.js that fires automatically on npm install. On Windows, install.js invokes hidden PowerShell -N...

Malicious code in polymarket-mcp-v2 (npm)

polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on npm install. It steals Solana keypairs, .env secrets and other credential files, and installs an attacker-controlled SSH key into /.ssh/authorizedkeys, then opens port 22 for persistent access. Any...

MAL-2026-10176 Malicious code in uncaxss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acda9720ae54881219c0fbcee73795be85877d292aa62662f7cb6b92e775f608 Package ships an obfuscated dist/index.js that is invoked from the postinstall lifecycle hook node dist/index.js. At install time, the script perform...

MAL-2026-10129 Malicious code in rtc-integration-frontend-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acfd49527fb8be1135feb424b68f6c46779ba146d8372d276eac1735770d6e5a [email protected] registers a postinstall lifecycle hook "postinstall": "node index.js" that fires automatically on npm install...

MAL-2026-10094 Malicious code in @equansservices/setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b071598889a04c74a8398157555ccfffda5bbc713429df4cafbcf48df7f811af package.json declares a postinstall hook node setup.js that fires automatically on npm install. setup.js selects a platform-specific target and fetch...

MAL-2026-10086 Malicious code in dl-pp-latm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e21f1adb71c41838848c4d4292830a9738895d32a5b0f1f098e1efdadb233716 Package [email protected] registers both preinstall and postinstall lifecycle hooks that run index.js, which collects installer machine identifiers —...

MAL-2026-10079 Malicious code in vybscan-testbed-obfuscated-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9aee5b150e0606b1c5c2469fdab43496965a3dd5664df288d68d618e326567 package.json declares a postinstall lifecycle script that runs node -e "evalBuffer.from'','base64'.toString". Installing the package triggers executi...

Malicious code in @wagni_bot/ethereum-wallet (npm)

The npm package @wagnibot/ethereum-wallet is a supply-chain credential stealer disguised as a an Ethereum wallet library SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

Malicious code in @wagni_bot/wagni (npm)

The npm package @wagnibot/wagni is a supply-chain credential stealer disguised as a the campaign's own namesake handle SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

Malicious code in @wagni_bot/metemask-sdk (npm)

The npm package @wagnibot/metemask-sdk is a supply-chain credential stealer disguised as a MetaMask misspelled 'metemask' SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

MAL-2026-10022 Malicious code in @wagni_bot/binance-sdk (npm)

The npm package @wagnibot/binance-sdk is a supply-chain credential stealer disguised as a Binance SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/polymarket (npm)

The npm package @wagnibot/polymarket is a supply-chain credential stealer disguised as a Polymarket SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...