MAL-2026-13797 Malicious code in cvbniydplwe3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9edbef37139b40a366aacea90abbd4b80ca581921f213b98ffb17db3b857bfcd The tarball contains only index.html declared as package.json main and no JavaScript, no lifecycle scripts, and no Node-executable entry point...

MAL-2026-13814 Malicious code in hlksdcixycvf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91dec68a77b15daa1f923bcfe876d283a8fea8d8cdf3d2ea27888b8eb522b97 The tarball contains a single file, index.html, declared as the package main. The HTML renders a Cloudflare Turnstile-themed 'verification' page...

Malicious code in prezdentkxheiw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b524c1b4d84ba3f109eddb254753a02dac72fa61397c4f03dbcbb814c6aaa68f The package contains only index.html declared as main and package.json. The HTML impersonates a Cloudflare 'Just a moment...' challenge and includes ...

MAL-2026-13844 Malicious code in xhjckswqivb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a9d37b433e22c980e67c0a2991612592959f6998df3928a6a09792ecf4860bb Package contains only index.html and package.json. The HTML mimics a Cloudflare Turnstile challenge and, when loaded in a browser, assembles an...

Malicious code in vczxijghsvizu4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bae2fa8ce447bf7b8dbe7b16f14e37b56f713aff508b26f937188a1570d8309 Package [email protected] contains 2 files with no a static rule matches and no traced behavior indicating exfiltration, install-time code...

MAL-2026-13794 Malicious code in clxofwfjskaz7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b4dde997a29794d4dfbb4725da833fa7cb4a221dc91d6b820901745eb77f198 The tarball contains only package.json and index.html. package.json declares main: index.html and no lifecycle scripts...

MAL-2026-13842 Malicious code in vlbhvgovbbhfab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5b717c270d7c4f965a421923d78bff7a86b044999f557386a258c7050768620 Package [email protected] contains 2 files. No install-time lifecycle scripts, exfiltration primitives, hardcoded network destinations,...

MAL-2026-13839 Malicious code in vczxijghsvizu4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bae2fa8ce447bf7b8dbe7b16f14e37b56f713aff508b26f937188a1570d8309 Package [email protected] contains 2 files with no a static rule matches and no traced behavior indicating exfiltration, install-time code...

Malicious code in xhjckswqivb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a9d37b433e22c980e67c0a2991612592959f6998df3928a6a09792ecf4860bb Package contains only index.html and package.json. The HTML mimics a Cloudflare Turnstile challenge and, when loaded in a browser, assembles an...

Malicious code in bgncvhferucfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1bf8639ccc5d2a70ae2e0ce754b76e1ca525699413f5d696289714005e86c57 The package's sole content is a single obfuscated HTML file declared as main. When loaded in a browser, the page renders a fake Cloudflare Turnstile...

Malicious code in ms_aidc_com_tw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12bdd45f103beeee602be82a07277a3f0cb842ec3a9829e904911fe37bd2fd5 The package msaidccomtw ships only an index.html that renders a fake Cloudflare Turnstile 'security verification' page. On Turnstile completion,...

Malicious code in cjdfswifuem3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 565ffd2f5127412df02a03f80345ff2420dc5545b65abff5298eac3bf1bf2990 The package has no JavaScript module; package.json declares main as index.html, which cannot be require'd, so installing or importing this package...

MAL-2026-13821 Malicious code in mnchfnvbue1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff948b6e989a38a47cbb12d4e633d48a2069c04bb64066d66140f3b27835ef86 The tarball contains a single file, index.html, declared as the package main. The HTML contains heavily obfuscated JavaScript that mimics a Cloudflar...

Malicious code in bcnfjndwbkf2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1fc1ec45930a69372eadc47b662c5d82b247b5b4227feacda3d1c4302b4bf3 The package contains only index.html and declares main: 'index.html' with no scripts, no bin, and no JavaScript library surface. The HTML mimics a...

Malicious code in dhjksficgwu2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5dc64d0022ee36cd898963db50e3c835990bf94837821fb34408820855c69c0 Package contains a single index.html file declared as main. The HTML impersonates a Cloudflare Turnstile 'Just a moment...' verification page sitekey...

Malicious code in cxcbdjxcmncvfg2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0caba01ec3b437a50e1808290e06ae0d084836e6660a0fe90ad56e8cd80b0338 The package contains a single index.html that visually impersonates a Cloudflare 'Just a moment...' challenge page including a spoofed Ray ID and...

MAL-2026-13795 Malicious code in csbcldfvivwfgd4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6d7db017a0499c0fca67cc331c44fa736fe52568177990823cb17bd03ceee21 The package contains a single index.html declared as main. The HTML mimics a Cloudflare 'Just a moment...' challenge and contains obfuscator.io-style...

MAL-2026-13818 Malicious code in jkbnwsdf8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e67b8d2fe8ba4fcec395d1fa7497515b41f2e4edc7f25e12c2b4b4abcebe358 The package contains a single file, index.html, declared as the package main. The HTML is styled as a Cloudflare Turnstile 'Just a moment...' challen...

MAL-2026-13813 Malicious code in hgdvfuflnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfc8e3c1c86c0f0589e1ab4d2a6e3f3a757b758c1f126e0d197f3924d9637922 Package [email protected] contains a single file, index.html, declared as the package main. The HTML impersonates a Cloudflare 'Just a moment...'...

CVE-2026-19426

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...