MAL-2026-17544 Malicious code in @qngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664 Package @qngular/core is a one-character typosquat of @angular/core and copies the real package's description, author, and repository metadata. The...

Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

MAL-2026-17533 Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

MAL-2026-17529 Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

MAL-2026-17498 Malicious code in @kibt/www-nuxt-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of...

Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

MAL-2026-17437 Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

Malicious code in test-agency-assignment-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9944ea8ca21c0670c4b718a12427e8ca7330571ef5a9198a60b05f75038fe73 The tarball contains only package.json and 4444.vbs; the declared main entry index.js is absent. package.json defines a postinstall script wscript.ex...

MAL-2026-17297 Malicious code in test-agency-assignment-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9944ea8ca21c0670c4b718a12427e8ca7330571ef5a9198a60b05f75038fe73 The tarball contains only package.json and 4444.vbs; the declared main entry index.js is absent. package.json defines a postinstall script wscript.ex...

MAL-2026-17295 Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...

Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...

Malicious code in @hrmony/kit-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a4084c44ab6554d66c474338de2cb482a25b31e6822d470e08b2b2ef5b1735a The package executes credential-harvesting code both from its postinstall script scripts/check-setup.mjs and from its main entry index.js, so theft...

Malicious code in dotenv-precheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e [email protected] is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, ...

MAL-2026-17304 Malicious code in dotenv-precheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e [email protected] is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, ...

Malicious code in test-agency-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm...

Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

MAL-2026-17229 Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

Malicious code in chalk-figlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry...

MAL-2026-17223 Malicious code in chalk-figlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry...

MAL-2026-17225 Malicious code in fabric-render-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01 package.json declares postinstall="node index.js", so npm install fabric-render-bridge automatically executes index.js. index.js reads Minecraft...