148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed denial-of-service botnet for roughly two weeks in May, according to new research from JFrog. The packages did not go after the developers who might install them. The operators used the...

MAL-2026-10510 Malicious code in type-astr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89817054cec44ec8ba09dd26af025483096055c0a931172bd4a63910dceb87fc The package presents itself as a pino-compatible logger exports a middleware aliased as pino, ships pino-like files such as proto.js, redaction.js,...

MAL-2026-10132 Malicious code in react-jsonwebtoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b46ca6ae72ce6f079c34ec6d1d1d2be46b36fe429374393f0fe57539fe56ee3 Package name mimics the widely-used 'jsonwebtoken' library and falsely declares 'auth0' as author, while the repository URL points to the unrelated...

MAL-2026-10072 Malicious code in polymarket-trader-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54436b6dea3d66e295c1ca82184b4f4b904d8441a68e77845f37cbb039c5f3c9 [email protected] advertises itself as a Polymarket trading helper but its main entry is a remote code loader. The default-exported...