Malicious code in preinstall-hook-webhook-callback-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1 package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an...

MAL-2026-5449 Malicious code in morningstar-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18591ac1a5cb5ca3d11e07bde38f230dccc530bb4614d45f9be1f547677a2c9e On npm install, the package's preinstall lifecycle script runs wget against a hardcoded bare-IP HTTP endpoint, passing the output of id, pwd, hostnam...