MAL-2026-13776 Malicious code in upshift-config (npm)

upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk. The version 0.5.14 is fabricated to imply a release history the package does not have it is a first-ever publish. Its body is byte-identical to augustdigital-s...

MAL-2026-13777 Malicious code in upshift-finance (npm)

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...

Malicious code in augustdigital-sdk (npm)

augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package @augustdigital/sdk. Version 8.20.1 was copied verbatim from the genuine @augustdigital/[email protected] release published 2 hours earlier to masquerade as a legitimate mirror or...

MAL-2026-13774 Malicious code in augustdigital-sdk (npm)

augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package @augustdigital/sdk. Version 8.20.1 was copied verbatim from the genuine @augustdigital/[email protected] release published 2 hours earlier to masquerade as a legitimate mirror or...

CVE-2026-48159

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

MAL-2026-13695 Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

MAL-2026-13453 Malicious code in pilgrimage-portal-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28 On npm install, the package's postinstall hook runs node ping.js, which reads the installer's hostname via require'os'.hostname and POSTs it, along...

Malicious code in @kite-js-tools/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9 package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall hook performs an HTTPS GET ...

Malicious code in luluking3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays...

Malicious code in luluking2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 495a71c4dcddec545026181c7faeef59cf4c79b4816a148fb88c59c5465e8c97 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL from a char-code array String.fromCharCode.apply on a numeric...

Malicious code in crypto-javas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9 The package's postinstall hook runs setup.js, which enumerates process.env excluding only a small OS blocklist for PATH/HOME/USER/SHELL/LANG, collect...

MAL-2026-12424 Malicious code in react-native-ui-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...

MAL-2026-12326 Malicious code in @offa/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8 package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname, os.userInfo.username, process.cwd, and the...

Malicious code in test22221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53 package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTT...

Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

Malicious code in aegis-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a66d1f02c3c943836d41a7ec92c150c5529880890a4cc502115412dddb0c519c The package's declared postinstall hook runs node src/test.js, which issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate...

Malicious code in datefmt-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787 datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall...

MAL-2026-12216 Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...