MAL-2026-11445 Malicious code in @nordic-dev/linting-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0054a3ea54efe5ff365eb71e92db7d2cb4e92a63854489c148660a82d083c16d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11449 Malicious code in @sof-assistant-fe-lib/vertical-faqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d1ba538ee75936802bcb54b49dd258a1941bf7b9f07bc0b05db81fd656c47e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11452 Malicious code in @sw-commons-components/message-upsell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee504d58bc907a09044cba70345cf7bc8cf2266c20833ce8bae2866b205208c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11436 Malicious code in @finance-ui/finance-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b752ae2cd0e6a1f9faf2b0c3376aa390e9708b86705621087e72e95de4333448 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11444 Malicious code in @mplay-frontend-ui/link (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6f2d06b568af724d0c5db157ecd8894e51acca5e9f1ae3d965ca5775afe852e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cr-invested-ui-components/chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c6439b3541927d90da8118ef84eda4e7bedf70c59293c1dc695bb2219135cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @finance-ui/snackbar-ifpe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44977ea381cb1ef71bae69849b3091ee76769ad26363ba31525f96ca1128bda7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11473 Malicious code in metrics-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...

Malicious code in metrics-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...

Malicious code in refbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...

Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

MAL-2026-11477 Malicious code in refbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...

Malicious code in iwomm-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc6a86a4bd25e85d55ccc7babe614b8cf8eb1b31572b67b1f463ad0302263669 lib/report.js imports childprocess, fs, https and os, collects host and user identity data via os.hostname and os.userInfo lib/report.js lines 160-16...

Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ee88b53e786db18609f7956c556a7f814b476c895bb90d5663aedc82ca14f0 Package name 'mcp-server-boilerplate' is unrelated to the Model Context Protocol ecosystem it evokes; the shipped code is a data-collection payload...

Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

Malicious code in paraglide-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22f62eaf75227ca79ee8d113b790e60589d2f29204db3e6f3939e3dd3c7527cf Package name closely resembles the widely used @inlang/paraglide-js i18n library, but the declared main entry index.js is only a helloWorld stub. The...

MAL-2026-11459 Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

MAL-2026-11474 Malicious code in paraglide-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22f62eaf75227ca79ee8d113b790e60589d2f29204db3e6f3939e3dd3c7527cf Package name closely resembles the widely used @inlang/paraglide-js i18n library, but the declared main entry index.js is only a helloWorld stub. The...

Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...

MAL-2026-11458 Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...