MAL-2026-10670 Malicious code in eslintcmd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf4500fbbfc85f42275772210ace6efb69c5f90d9d0a5edd7c0c75fa271f0c3 The package's postinstall script scripts/install-check.cjs fetches a JSON config from https://slimopump.vercel.app/config/clob-math.json, downloads...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

MAL-2026-10587 Malicious code in dayjscore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9b2226f2ebbeccf1bcafbec9c51e2b3f13e3a7712dfc22baa79fbb72393b8a The package's package.json declares scripts.postinstall = "node.init.js", causing.init.js to run automatically on npm install. The script harvests a...

MAL-2026-10584 Malicious code in chalkdevx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates 65 credential and CI environment variables NPMTOKEN,...

Malicious code in home-mp-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single...

MAL-2026-10466 Malicious code in polymarket-math-stake-kelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to...

MAL-2026-10467 Malicious code in polymarket-stake-kelly-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01715ebd11c8adf6ac26ce11bc5fc07e6cfb6775fa77dbe1ca022d0d6593b99c [email protected] ships a postinstall script scripts/install-check.cjs referenced by package.json's postinstall hook that on every np...

MAL-2026-10429 Malicious code in @nsub/nitxe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16147b7ac55d6c4cc4e042be73e6d49fc7232e8a03f406fecd034cdd27bf0eb The package's declared npm postinstall script collects the installer's username os.userInfo.username, hostname os.hostname, platform, and the entire...

Malicious code in terminal-mascot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fdf1ac60d0060cb78970c884bcfa7bb5360d9f700c0f8992b66af09cce22ae [email protected] ships a postinstall script install-check.cjs that resolves a bundle URL from a remote JSON config at...

MAL-2026-10407 Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

Malicious code in @car_loans/dealerships-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d @carloans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json...

MAL-2026-10217 Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

MAL-2026-10201 Malicious code in bugexploit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745f81b0c53fa121939d4f71680783860795a394eb30308f6e7e2dcf29401c92 package.json declares a postinstall script that runs node index.js. On npm install, index.js collects the installer's username os.userInfo, hostname...

MAL-2026-10199 Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

MAL-2026-10093 Malicious code in @andrewstory18/is-real-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a6faaf0fbf39ed9ec8797c97cb8b2486be8b84eb46bfeabc3412a3eeded4aa1 @andrewstory18/is-real-odd impersonates the widely-used is-odd package by copying its README, author, and repository metadata verbatim, but ships an...

Malicious code in vybscan-testbed-obfuscated-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9aee5b150e0606b1c5c2469fdab43496965a3dd5664df288d68d618e326567 package.json declares a postinstall lifecycle script that runs node -e "evalBuffer.from'','base64'.toString". Installing the package triggers executi...

Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

MAL-2026-10078 Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

MAL-2026-11111 Malicious code in @wagni_bot/hyperliquid (npm)

The npm package @wagnibot/hyperliquid is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...