MAL-2026-5938 Malicious code in speed4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766e347295e7a13e0604a89de30f662a24b690598f1e4b01edaac5400178347 [email protected] is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker importScripts'./8cfc2/hgshm.js...

Malicious code in nottuff23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41d429b099904a530f5dc4dfdd4724b7b6160c1de1330e0b103e8b8e3c737dfd The package is one of approximately 100 identically-named-pattern publishes from an automated bulk-publish operation. The tarball ships...

Malicious code in nottuff25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 238a4f56f3433bf34de372e9a26264a33e33c6bde8592ddc73594d33ab7427f0 The tarball is not a Node library. package.json declares main: sw.js with description "package" and an empty author; sw.js is a browser ServiceWorker...

MAL-2026-5916 Malicious code in nottuff25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 238a4f56f3433bf34de372e9a26264a33e33c6bde8592ddc73594d33ab7427f0 The tarball is not a Node library. package.json declares main: sw.js with description "package" and an empty author; sw.js is a browser ServiceWorker...

CVE-2026-45578 WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/onpublish.php builds an execAsync command line by string concatenation, single-quoting each argument but never calling...

Malicious code in @kruzer/lib-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1bb1f66615de2b0b161721218d2bff4bb0e7100b5cb28b764fcc2e6f1ee671f The published tarball's package.json contains a hardcoded npm registry auth token embedded in the build:publish script: npm publish --tag alpha...

Malicious code in sudo-reject-mu-proxy-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71bd21ebc82601b1500c1ec0b38beaf261822f483579359312b433a31d3a139a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bash-xml-transpile-good-catch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c110031cbd21ee061558e5100a9248d1164f381595f8ccb51846f7926733560 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in planckscale-ora-envconfig-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb106b457d5f917ba8c7114dbb5f21f91e8bfd4bc12332d92ae52143d6d392e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in awk-node-abstract-interpret-alert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57b94267f695268b2205969adaa9a5ec8130180999c45d34e32b1a23caa7f70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cressida-jwt-loglevel-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c579391a28b717cc3bab01d83cefe0a9573ccb0c4b8dee4c27e98fcb9b1adac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superposition-unuk-spectroscopy-borealis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 447a420e2f7492d5062a141b6b5f5bf8ca06267753ff8c144ff4da6937865934 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in simulate-small-enum-protected-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 672b0b691d23d606b8429a3496d6d9093a46d4507098ad9e64bd69460d7bc129 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in delta-sun-psi-new-byte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374cdc7d058badce2f6a42696c611854a14f6b677f5cc78ec1c95958aa1ee55b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tectonophysics-transform-crust-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 362c7a3c2a387c1b0b23c2ad16e0ff6e12215ac224b7fe3f752d831110cf1fcd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cat-meta-stack-minify-try (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80dec973455eae025b75ae4a2fb66d3f693521c903c9ca3af246808867e0af65 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in google-radiant-weywot-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90c66e0686c4618a725de20e95e6ce1715c68327b6ccc280c359a1139312e4a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in log-slow-debug-zero-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78fd3a990df8eb8d56e45ec770b108e1834d4459466ee6772f3bce67e6c803c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-playwright-selenium-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c754c3bfd1ff8786771ed58cb3d42e85de78b7b2210d6d9979d54019bdb9ae60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nebula-lyra-astrophysics-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87731194882f0a9904a010dc5c887ceff5fea966c6f645da196e94537a27f879 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...