Malicious code in moidevy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664 main.js imports childprocess and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal referenced at lines 358 and 452, with...

MAL-2026-14047 Malicious code in @guangnao/agent-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06 On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint hub.client-llm.com, reconstructed...

MAL-2026-5600 Malicious code in 0x2ai-multi-mq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d056f067b0af2084bd7777fcdb2ae6e2c06bb67f40929ba9900b5aa9cb83649 When the documented invocation npx 0x2ai-multi-mq is run, bin/start.cjs copies chatroom-mcp-lite-patched.cjs and chatroom-monitor.cjs into the user's...

Malicious code in 0x2ai-multi-mq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d056f067b0af2084bd7777fcdb2ae6e2c06bb67f40929ba9900b5aa9cb83649 When the documented invocation npx 0x2ai-multi-mq is run, bin/start.cjs copies chatroom-mcp-lite-patched.cjs and chatroom-monitor.cjs into the user's...

MAL-2026-3757 Malicious code in claw-subagent-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2ccba152d6841731431c91157874c72b5f9778fdf88b634a45ab5d9da961307 On npm install -g, the package's scripts/post-install.js registers a privileged Windows service claw-subagent-service pointing at service/daemon.js,...

MAL-2026-2452 Malicious code in strapi-plugin-blurhash (npm)

strapi-plugin-blurhash is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network topolog...