Malicious code in desmosistuff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c61a3c57b3649dc23c3534ad9f8b872093353a38ed7995af9cda6d4102bee8b0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in classroomhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b64edbbd8d1e23d937c4697de257a67981be2ebb2934a4280424a86f4af7028f The package's index.html impersonates Google Classroom title, gstatic favicon, hardcoded student email [email protected], decoy schedule/gradebook...

Malicious code in schoolwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fab9688948b5e3cab55bea7282280a554f1e60f85b947724b5f9262cd6a1823 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tungtunggod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cfc083fc4a77544ba957b1c1d771998929fc71453f905f6d9c474e2bd3fb51f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tungtungisgoated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d649ce9c915a5834ac0743a8f47377d31c293de34fbe40581c2f7ce3ca56c8da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in iamhungryrn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 462bbc47c25a6f0d3de4221795fe1a35ea55027682c037d1a8ed8693b0993d89 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in livemcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80caa46e4bb231b0640c11ecb691ccf936f316205010487c57178eaf2100e8f7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dext-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329047f71cd6b35084bea7ed22978ba88e02cb557a5490b6133a70a5a0859a19 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14385 Malicious code in hydration-dim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3659ec02e8317602c089b822a4a0533bee515d9666d07fdaf3cdf8b315a46147 On import, dist/index.mjs verifies a SHA-256 digest of a bundled Linux x8664 ELF at dist/internal/calc.dat, chmods it to 0755, and spawns it detached...

Malicious code in @sdgdfgdfhhhfd/multiviewr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e2d548769641b2114a424739448d9df85d67cc176e694c6ff34ede446082b76 This package publishes a MetaMask snap that derives BIP44 entropy for coinType 60 Ethereum and transmits the resulting privateKey, publicKey and...

MAL-2026-14382 Malicious code in @sdgdfgdfhhhfd/chainvista (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf04f8e698eac423b3ba255617c60c9167b4b3453b7d73966ad62b02e0695a1 This MetaMask Snap derives BIP44 entropy for Ethereum coinType 60, Bitcoin 0, Solana 501, Cosmos 118, and Testnet 1 and POSTs the raw privateKey,...

MAL-2026-14357 Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

MAL-2026-14354 Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

CVE-2026-62669 Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

MAL-2026-14129 Malicious code in plugin-react-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c068ede55759ccbff349be0990eab7756ca43a5eed8a60a805e69e8c32626a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in hxckdoeaqjlc8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324cd3fd06a0d97ae5fb9263df818bc505d28ebcdda8e90814b5630de70e108 The package ships a single HTML file that impersonates Cloudflare's 'Just a moment...' interstitial. On Turnstile widget callback, embedded JavaScrip...

Malicious code in mobicwkgjmx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 790620aeb9129471875ad3bbfd9e5c379b4cf2a8a5cbc920148be5d37ca3f9d1 Package [email protected] contains only two scanned files and no static or traced findings indicating credential access, install-time execution of...

Malicious code in fetch-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5c49646ea7e22e74073aa7d8c9596d7d93100c429033383e975a2ab080de28 Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' repository, README, and author metadata all reference...

MAL-2026-13669 Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...