MAL-2026-13304 Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...

Malicious code in beaver-ui-search-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae The package presents itself as a UI dropdown library but on require executes init.js, which selects a platform-specific asset linux/darwin/win32,...

Malicious code in bigops-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d8d967bce96a9d30c6af4599e7658d63327067655539f14f2bfd1cd8a663350 The package advertises itself as a stylelint 'quality gate' but on require its main entry loads bootstrap.js, which downloads a platform-specific...

MAL-2026-12755 Malicious code in devplatform-spa-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26 index.js requires./polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers...

Malicious code in afisha-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13 On require of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscated mirror hosts...

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

Malicious code in twork-data-services-sme-agent-company-relation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967bdfae105295a824e45402395d3b82a515d225081bc94f4d5998b2884df38 index.js unconditionally requires./init on module load. init.js assembles host names at runtime via array join to hide them from static scanners, the...

Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12236 Malicious code in tinkoff-codeceptjs-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 253cf41e1be3d79a36e40038dd5e4776355c95c4eeb41aa40a0b4c7aa321c613 On require of this package, index.js unconditionally loads helpers.js, which at module load time downloads a platform-specific binary from...

MAL-2026-10576 Malicious code in tennacity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7933cd1ec11531feba788870555eeac615535d8e230b4d252880def9c68ff5e tennacity is a one-character typosquat of the popular 'tenacity' library; its README/PKG-INFO are copied verbatim from real tenacity while setup.py...

MAL-2026-4357 Malicious code in helu (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 15a97c1f0e23d838c86d69a3ceae306071a9b4b8c17162a1f563aefe489ffbe4 During import, the hidden code downloads and executes the second-stage code. After performing anti-analysis checks, it downloads a malicious executable and...

Suspected Exploitation of Apache ActiveMQ CVE-2023-46604

Tom Elkins, John Fenninger, Evan McCann, Matthew Smith, and Micah Young contributed attacker behavior insights to this blog. Beginning Friday, October 27, Rapid7 Managed Detection and Response MDR identified suspected exploitation of Apache ActiveMQ CVE-2023-46604 in two different customer...