MAL-2026-10446 Malicious code in react-markable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da0db97919f41757fe4bcdc456d52ec0ecfbb89741438e5805a7bf5188b022c5 [email protected] is a typosquat of markdown-table declared repo field wooorm/markdown-table. package.json declares a preinstall hook that...

Malicious code in animated-css-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257 The package presents itself as a PostCSS plugin for animate.css, but its main export src/plugin.js createPlugin synchronously triggers...

MAL-2026-10432 Malicious code in animated-css-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257 The package presents itself as a PostCSS plugin for animate.css, but its main export src/plugin.js createPlugin synchronously triggers...

MAL-2026-10426 Malicious code in chai-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ffc5e8b4e25d2d7787eb9f3bb9607114e5e4290f0afe2350499b78d5f95642 [email protected] presents itself as a Mocha reporter mirroring the legitimate eth-gas-reporter project matching author name, README, and badges, but th...

Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

MAL-2026-10414 Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

Malicious code in @car_loans/dealerships-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d @carloans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json...

MAL-2026-10397 Malicious code in @car_loans/dealerships-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d @carloans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json...

Malicious code in mongoose-schema-unique (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca index.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD an anonymous, mutable, public...

MAL-2026-10184 Malicious code in mongoose-schema-unique (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca index.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD an anonymous, mutable, public...

MAL-2026-10180 Malicious code in auth-next-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0926f0a2c1f47072efaac014be38bb00c8e9f31f59badf188b1ed74dd5c2ce On require of auth-next-gen, index.js loads lib/writer.js, which at module top level performs an axios GET against a base64-obfuscated URL...

Malicious code in uncaxss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acda9720ae54881219c0fbcee73795be85877d292aa62662f7cb6b92e775f608 Package ships an obfuscated dist/index.js that is invoked from the postinstall lifecycle hook node dist/index.js. At install time, the script perform...

`exploration` was removed from crates.io for malicious code

A method within the exploration crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Rustsec to Kirill...

GHSA-99J7-FHR2-XFJ4 `exploration` was removed from crates.io for malicious code

A method within the exploration crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Rustsec to Kirill...

FTP Fetch, Bind TCP Stager (No NX or Win7)

Fetch and execute an x86 payload from an FTP server. Listen for a connection No NX Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP inclu...

FTP Fetch, Reverse TCP Stager

Fetch and execute an MIPSBE payload from an FTP server. Connect back to the attacker Module Options msf use payload/cmd/linux/ftp/mipsbe/meterpreter/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...show and set...

MAL-2026-10156 Malicious code in notify-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fec337f1c1858ad605f875ea51feb09f84fbd2eb702c7bc0462dbb427b3eff05 [email protected] presents itself as the pino logger export name pino, README and type definitions mimic pino, npm version badge points at the...

MAL-2026-10154 Malicious code in notify-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf89f8fbe4c3f9ae9494077688977f46c8b3f875a552054508ac5eec7b62344 notify-dist advertises itself as a pino-compatible logger/middleware exports module.exports.pino, keywords fast/logger/stream/json, lib/ mirrors pino...

Malicious code in notify-funcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b65341bde476af6b80e1fbaa9f9a844b7fdc023ef02f5fabb88514d88012159 The package presents itself as a pino-compatible logging middleware exports check as both default and pino named export but its actual behavior on...