Malicious code in cacheable (npm)

npm/cacheable version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

Malicious code in internallib_v568 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755dfc0e12b6602ff21d04446f2c6bdc23499c0bd9645c14b9209dc25fbb0be5 [email protected] is shaped as a dependency-confusion artifact against a private package name. The main module exports a payload containing a...

CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

Malicious code in simple-date-formatter-util-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...

MAL-2026-11484 Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

MAL-2026-11491 Malicious code in test-dev-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b3df759cd11b9c662bed5840b0671d4e9c54a76a606d284ca39390ecf51f8d [email protected] connects out to a hardcoded socket server host/port sourced from the test-dev-config module and enters a receive-loop that...

Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

MAL-2026-11455 Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

MAL-2026-11466 Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ee88b53e786db18609f7956c556a7f814b476c895bb90d5663aedc82ca14f0 Package name 'mcp-server-boilerplate' is unrelated to the Model Context Protocol ecosystem it evokes; the shipped code is a data-collection payload...

MAL-2026-11469 Malicious code in iwomm-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc6a86a4bd25e85d55ccc7babe614b8cf8eb1b31572b67b1f463ad0302263669 lib/report.js imports childprocess, fs, https and os, collects host and user identity data via os.hostname and os.userInfo lib/report.js lines 160-16...

Malicious code in sap-mcp-facilitator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8470f17eabef0f8e78467a643e0bcd4598174a0647c241145e3a7a857156a64 lib/report.js collects the installer's developer identity — os.userInfo.username, os.hostname, and the git/GitHub email invoking gh api user/emails...

MAL-2026-11465 Malicious code in hazmat-cfr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 670ac0a193b6b9a6afb01457c68700468026e76943f07cdf100d2d85601be2b3 lib/report.js reads local files fs.readFileSync at lines 31 and 72, collects host and account identifiers via os.hostname and os.userInfo lines 160,...

Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

MAL-2026-11462 Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11461 Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee541a67169360e2d9ac3da7d19353031dd395c5e1bbe05bb4540ccc4837fa3 The package's exported getPlugin/setPlugin functions, when invoked by a consumer, decode base64-obfuscated string constants svgValidateKey,...

Malicious code in famshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25590ceaca7a7491267e3152f276e90e1d5dd7eee7f3a86bee0c2b7666c0427 No a static rule matches and no traced-code findings are available for this package version. With no concrete behavioral evidence in either signal...