MAL-2026-17288 Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

MAL-2026-17290 Malicious code in @rutxploit-sec/waves-button-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...

Malicious code in @hrmony/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6976b2f9327b9a181d77cd0597ef2f657575961a3d47ef8c57de1f6d4141503d On require/import, index.js contacts the EC2 Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates the instance's IAM role...

MAL-2026-17263 Malicious code in @hrmony/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6976b2f9327b9a181d77cd0597ef2f657575961a3d47ef8c57de1f6d4141503d On require/import, index.js contacts the EC2 Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates the instance's IAM role...

MAL-2026-17265 Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

MAL-2026-17266 Malicious code in @hrmony/kit-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5 The package's preinstall script and its main entry index.js both perform identical credential-harvesting: they query the EC2 Instance Metadata Servic...

Malicious code in express-nodejs (npm)

The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17244 Malicious code in exprrdd (npm)

The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17247 Malicious code in exptredd (npm)

The package exptredd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17294 Malicious code in react-nodejs (npm)

The package react-nodejs impersonates the legitimate 'react' package it republishes react's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17243 Malicious code in express-nodejs (npm)

The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17248 Malicious code in xeprews (npm)

The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17242 Malicious code in express-javascript (npm)

The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exptred (npm)

The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17241 Malicious code in exprdd (npm)

The package exprdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17246 Malicious code in exptred (npm)

The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exptrdd (npm)

The package exptrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exptredd (npm)

The package exptredd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17245 Malicious code in exptrdd (npm)

The package exptrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...