MAL-2026-10606 Malicious code in base58-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772 The package's index.js contains multiple Buffer.from... decode sites lines 7, 29, 34, 49, 50 used to reconstruct strings/payloads at runtime — the...

Malicious code in @tqm-mfe/main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba70610a96625984d6a26c5cfba828a98fad70a559f34eb881289f9ce4f625a1 scripts/postinstall.js is a heavily obfuscated obfuscator.io-style: 270+ entry rotated string array, RC4+base64 decoders, hex-encoded dispatchers...

Malicious code in endpointmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa2ddbcbdd90508af14415a021644c1ab8a57e432b526425e4c5128b23f897bb endpointmap advertises itself as a REST endpoint registry but exhibits a two-package smuggle pattern. lib/registry.js exports two non-printable byte...