MAL-2026-14334 Malicious code in arone (crates.io)

arone is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

Malicious code in lodash-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm...

Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and...

MAL-2026-13539 Malicious code in delivery-ci-codeceptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0287654a4d9fa3f7e6f9a35c8bf06a8bb4f18fbbc3a5b3df3450a6c681897b49 On require of the package's main entry, helpers.js runs a setup routine that selects a platform-specific payload path via a DLMAP table and downloads...

Malicious code in dolyame-ui-inputtag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8 On require of the package's main entry, index.js loads init.js which downloads a platform-specific executable from hardcoded oob-worker..workers.dev...

Malicious code in dolyame-ui-inputsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146bdcb21ca52b35e8a6f3ca19b7203b1fb5a456eb9dff6ace2eb60348333fe [email protected] is a dropper disguised as a UI input search component. On require, index.js loads./vendor.js, which assembles a mirror...

MAL-2026-13486 Malicious code in fastapii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf67e733322de0ce3d08269697e6ccd9460233319cadd5f97f05c8d1e855665a fastapii 0.1.2 is a single-character typosquat of the popular fastapi package. Its setup.py registers a custom setuptools install cmdclass LinuxInsta...

Malicious code in bigops-products-insurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f2dd9bdb83df26b3425759cb4579da8e3a2748a5c995370ce1095c6010abf3c On require, index.js loads ext.js which downloads a platform-specific binary from hardcoded remote hosts assembled by joining string fragments...

MAL-2026-13291 Malicious code in dolyame-boxy-atom-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdafe79f11030f0367fb997cf61cabd383309aca2ba694459be72a97d8023bb7 On require of the package, index.js loads helpers.js which immediately runs an init routine that fetches a platform-specific binary over HTTPS from a...

MAL-2026-13124 Malicious code in ded-aa-liza-ded-aa-liza-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074f0a8014fabe8bdb281c1c07180290bcff2b10d67d723f1c7917ea198d5c5a On require of ded-aa-liza-ded-aa-liza-core, index.js loads ext.js which downloads a platform-specific binary from hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-checkable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c index.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of...

MAL-2026-13157 Malicious code in dolyame-ui-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21d1f60c7f97ffdc8e698c9804d9d9116f286be7a026a9c90f6e4a1858dea18 On require'dolyame-ui-grid', index.js loads polyfill.js which selects a platform-specific asset, downloads a binary from one of four hardcoded...

Malicious code in beaver-ui-pagination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8f562892f21caf2a12230c52507a333a5ada223f98964094838657072adcb On require'beaver-ui-pagination', index.js loads init.js which selects a platform key and downloads a binary from string-split-obfuscated hosts...

MAL-2026-12916 Malicious code in bnpl-blocks-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d63ed62a217e197558ea54716acadb75a5a4c6a7b57545b5ec8c8d86abb656 On require, the package's main entry loads ext.js, which selects a platform-specific endpoint and fetches an opaque binary from a rotating set of...

MAL-2026-12960 Malicious code in bnpl-blocks-independent-bnpl-main-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85d01515b559e3e623341b5838615add9439fc1d3942948acb3ca2aee86e9579 On require of the package, index.js loads bridge.js whose top-level run downloads a platform-specific binary from author-controlled Cloudflare Worker...

MAL-2026-12994 Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805 On require of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three...

MAL-2026-13107 Malicious code in bpm-foundation-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91 On require'bpm-foundation-common', index.js loads loader.js which assembles C2 hostnames via runtime string-joining e.g...

MAL-2026-13110 Malicious code in bpm-foundation-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2628bc930d903e5a69d6827559867687193357682be11a6caed59a65941caaf On require of the package, adapter.js runs a setup routine that detects the host OS and architecture, reconstructs Cloudflare Workers hostnames from...

MAL-2026-12515 Malicious code in bpm-foundation-test-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e On require, index.js loads setup.js which assembles destination hostnames at runtime from split string fragments resolving to...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...